Gs1900 Hpv2 Firmware
Monthly
An unauthenticated adjacent attacker who can reach the web management interface of Zyxel GS1900 series switches running firmware through 2.90(AAHK.2)C0 can trigger an out-of-bounds write in the device's CGI program via a crafted HTTP request, with the potential for OS command execution (CVSS 3.1: 8.8, AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H). The CPE data lists the whole GS1900 family as affected - GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -HPv2, -48 and -48HPv2 - so exposure is not limited to the GS1900-24E named in the description. No public exploit code and no confirmed active exploitation were identified at time of analysis; Zyxel published a security advisory on 11-03-2026 and the issue is prioritised for remediation this week rather than as a drop-everything emergency, because the attacker must first be on the same adjacent/Layer-2 network as the switch's management plane.
An unauthenticated adjacent attacker who can reach the web management interface of Zyxel GS1900 series switches running firmware through 2.90(AAHK.2)C0 can trigger an out-of-bounds write in the device's CGI program via a crafted HTTP request, with the potential for OS command execution (CVSS 3.1: 8.8, AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:H). The CPE data lists the whole GS1900 family as affected - GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -HPv2, -48 and -48HPv2 - so exposure is not limited to the GS1900-24E named in the description. No public exploit code and no confirmed active exploitation were identified at time of analysis; Zyxel published a security advisory on 11-03-2026 and the issue is prioritised for remediation this week rather than as a drop-everything emergency, because the attacker must first be on the same adjacent/Layer-2 network as the switch's management plane.