A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 20
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Zyxel Gs1900-8_Firmware
cpe:2.3:o:zyxel:gs1900-8_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahh.2\)c0
|
|
Zyxel Gs1900-8
cpe:2.3:h:zyxel:gs1900-8:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-8hp_Firmware
cpe:2.3:o:zyxel:gs1900-8hp_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahi.2\)c0
|
|
Zyxel Gs1900-8hp
cpe:2.3:h:zyxel:gs1900-8hp:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-10hp_Firmware
cpe:2.3:o:zyxel:gs1900-10hp_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aazi.2\)c0
|
|
Zyxel Gs1900-10hp
cpe:2.3:h:zyxel:gs1900-10hp:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-16_Firmware
cpe:2.3:o:zyxel:gs1900-16_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahj.2\)c0
|
|
Zyxel Gs1900-16
cpe:2.3:h:zyxel:gs1900-16:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-24_Firmware
cpe:2.3:o:zyxel:gs1900-24_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahl.2\)c0
|
|
Zyxel Gs1900-24
cpe:2.3:h:zyxel:gs1900-24:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-24e_Firmware
cpe:2.3:o:zyxel:gs1900-24e_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahk.2\)c0
|
|
Zyxel Gs1900-24e
cpe:2.3:h:zyxel:gs1900-24e:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-24ep_Firmware
cpe:2.3:o:zyxel:gs1900-24ep_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(abto.2\)c0
|
|
Zyxel Gs1900-24ep
cpe:2.3:h:zyxel:gs1900-24ep:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-24hpv2_Firmware
cpe:2.3:o:zyxel:gs1900-24hpv2_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(abtp.2\)c0
|
|
Zyxel Gs1900-24hpv2
cpe:2.3:h:zyxel:gs1900-24hpv2:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-48_Firmware
cpe:2.3:o:zyxel:gs1900-48_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(aahn.2\)c0
|
|
Zyxel Gs1900-48
cpe:2.3:h:zyxel:gs1900-48:-:*:*:*:*:*:*:*
|
— | — |
|
Zyxel Gs1900-48hpv2_Firmware
cpe:2.3:o:zyxel:gs1900-48hpv2_firmware:*:*:*:*:*:*:*:*
|
— |
2.90\(abtq.2\)c0
|
|
Zyxel Gs1900-48hpv2
cpe:2.3:h:zyxel:gs1900-48hpv2:-:*:*:*:*:*:*:*
|
— | — |
References 3
https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advi…
security@zyxel.com.tw
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026…
134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-governmen…
134c704f-9b21-4f2e-91b3-4a467353bcc0