Zyxel GS1900 EUVD-2026-115654

Exploitation requires the attacker to be on the same adjacent/Layer-2 network as the switch's web-based management interface (AV:A) and to reach the vulnerable CGI program over HTTP; no authentication and no user interaction are required (PR:N/UI:N). The affected condition is running vulnerable firmware - confirmed as 'through 2.90(AAHK.2)C0' for the GS1900-24E and, per the CPE list, the wider GS1900 series (GS1900-8/-8HP/-10HP/-16/-24/-24EP/-HPv2/-48/-48HPv2). The primary limiting factor is network adjacency: the management plane must be reachable by the attacker, so devices whose management VLAN/interface is segmented from untrusted hosts are not exposed to internet-based or remote attackers. The specific feature, request structure, or field that triggers the out-of-bounds write is not described in the available sources.

This is a genuinely high-priority issue but not a drop-everything emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an unauthenticated, low-complexity attack with full confidentiality, integrity and availability impact, and the vuln.today decision label is 'this_week', which aligns with a serious-but-not-active-exploitation posture. The single most important mitigating signal is the Adjacent attack vector (AV:A): the attacker must be on the same Layer-2/adjacent network segment as the switch management interface, not the open internet, which substantially narrows the realistic attacker population to insiders, compromised LAN hosts, or a pivot from an already-breached device. There is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis'. No POC or exploit reference is present in the input. The signals are therefore internally consistent (high severity, confirmed unauthenticated adjacent code-execution potential, but no exploitation evidence); the gap is the absence of EPSS/KEV data to gauge probability, so prioritization should rest on the asset's network exposure rather than on an exploitation-probability score that was not supplied.

An attacker already positioned on the same local network segment as a GS1900 switch (for example, a compromised workstation, a rogue device on an office VLAN, or a contractor on the LAN) sends a crafted HTTP request to the switch's web-management CGI program, triggering an out-of-bounds write. Because the vector is adjacent and unauthenticated, no credentials or user interaction are needed, and the corruption could potentially be leveraged to execute OS commands on the switch. No public exploit code or POC reference is present in the available data.