CVE-2026-107441

Think of this switch as the traffic cop directing data around your office network. This flaw is like a weak lock on the traffic cop's control panel — someone already inside your building's network (not just anyone on the internet) could potentially pick that lock and seize control of the switch itself, letting them snoop on or disrupt your network traffic.

This matters to you if you run any Zyxel GS1900 series switch — including GS1900-24E, GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24EP, GS1900-HPv2, GS1900-48, or GS1900-48HPv2 — on firmware up to version 2.90(AAHK.2)C0. The attacker needs to already be on your local network or adjacent segment to exploit it, not just reachable from the open internet.

There is no evidence yet that attackers are actively exploiting this flaw, and no public exploit code exists, so this is not an emergency fire-drill. However, the switch could be fully compromised by anyone who gets onto your local network, and since no vendor patch exists yet, you should tighten access controls now and watch closely for a firmware update.

Confirm exposure by inventorying all Zyxel GS1900-series switches and checking their running firmware version against 2.90(AAHK.2)C0 or earlier. There is currently no fixed version published by Zyxel for this CWE-787 out-of-bounds write in the CGI web management component, so patching is not yet possible. As a workaround, restrict the switch's web/CGI management interface to a dedicated, access-controlled management VLAN, disable remote management, enforce strong admin credentials, and segment the switch away from untrusted adjacent hosts (e.g., guest Wi-Fi, public-facing ports). Monitor Zyxel's security advisory page for a firmware release addressing this CVE and apply it to all affected models as soon as it is published. No CISA KEV listing exists, so there is no federal remediation deadline; track this as a standard medium-priority patch-when-available item, but prioritize network segmentation now given the high CVSS impact (confidentiality, integrity, and availability all rated High).

CVSS 3.1 score 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — high severity, adjacent-network attack vector, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. Weakness class is CWE-787 (out-of-bounds write) in the device's CGI interface, reachable via crafted HTTP requests and potentially leading to OS command execution. No PoC/exploit code is publicly known, the vulnerability is not listed in CISA KEV, and predicted exploitation likelihood is low with a flat trend. No patch has been released by Zyxel as of this writing; press attention is newly emerging.