Zyxel GS1900-24E Memory Corruption Explained

What happened

Zyxel has issued a security advisory covering memory corruption in GS1900 switches, including the GS1900-24E, and wireless access points, including the NWA110AX. Think of memory as a row of labeled storage bins: when software puts more into a bin than it can hold, the overflow can interfere with neighboring contents. These flaws involve software writing beyond the memory space intended for it.

The advisory covers CVE-2026-107441 in GS1900 firmware and CVE-2026-76955 in access point firmware. Their potential consequences differ: the switch flaw could allow operating system command execution, while the access point flaw could allow an attacker to gain greater privileges on the device. Both require network proximity as described by NVD; neither description establishes an attack path from anywhere on the internet.

NVD published both entries on 2026-11-03, assigning each a CVSS 3.1 score of 8.8 and HIGH severity. Neither CVE is listed in CISA's Known Exploited Vulnerabilities catalog as of the catalog check; that status alone does not establish whether exploitation has occurred. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-05.

Technical details

CVE-2026-107441 is classified as CWE-787, Out-of-bounds Write. NVD describes the issue in the CGI program of GS1900-24E firmware through 2.90(AAHK.2)C0. CGI is a mechanism that lets a web server run a program to handle a request. Here, a specially constructed HTTP request could cause the program to write outside its intended memory boundaries, potentially allowing operating system commands to run. The description does not identify the specific coding error behind the invalid write.

The switch attack does not require authentication, but it does require an adjacent attacker. In plain language, the attacker needs the network proximity required to reach the affected interface under those conditions. That distinction matters when assessing exposure: the description should not be read as proof that an arbitrary remote internet user can exploit every affected switch. Although NVD's description names GS1900-24E, Zyxel's advisory table identifies the other affected GS1900 models listed below.

CVE-2026-76955 is classified as CWE-120, Buffer Copy without Checking Size of Input, also called a classic buffer overflow. A buffer is a reserved area of memory; copying more data into it than it can hold can overwrite surrounding memory. NVD identifies the affected component as the zdp_wtp binary, an executable program, in NWA110AX firmware through 7.12(ABTG.0)C0. A LAN-based attacker could use the flaw to escalate privileges, meaning gain permissions beyond those already available. The description does not specify the attacker's starting privileges or the exact input that triggers the overflow.

Each flaw has a CVSS 3.1 score of 8.8, rated HIGH. CVSS is a standardized way to describe vulnerability severity, rather than a prediction that a particular device will be compromised. The matching scores do not make the flaws interchangeable: they affect different components, have different stated attack conditions, and require firmware matched to the exact device model.

Weakness types: Memory corruption

Who is affected

Everyday users

For everyday users, these issues concern the software running on network equipment. If your network uses an affected Zyxel switch or access point, the relevant fix is a device firmware update. The stated consequences concern commands or privileges on that equipment; the advisory descriptions do not establish that connected phones or computers are themselves vulnerable to these CVEs.

If someone else manages your network, give them the exact model name and ask them to compare its firmware with Zyxel's advisory. Model suffixes matter: NWA50BE, NWA50BE MAX, and NWA50BE PRO have separate firmware identifiers, as do the other variants in the advisory.

Developers

For junior developers, these flaws illustrate why memory boundaries matter in software that processes network input. An out-of-bounds write describes where a write lands; a classic buffer overflow describes a copying operation that lacks adequate size checking. Both can damage memory, but their effects depend on the affected program and its execution context.

If you support an application deployed on a network with these devices, coordinate with the people responsible for the equipment. Changing application code does not replace the firmware fix. Keep the switch command-execution issue and the access point privilege-escalation issue distinct when documenting exposure or discussing remediation.

Server and IT admins

For server and IT administrators, start with an inventory of exact models and installed firmware. The advisory's affected-and-fixed table extends beyond the GS1900-24E and NWA110AX named in the NVD descriptions. Check the full model coverage, including GS1900 variants and the IAP, NWA, WAC, and WAX entries.

Network placement is relevant because the descriptions require an adjacent or LAN-based attacker. Review which networks can reach affected devices, while treating the model-specific firmware update as the corrective action. WAC500H needs separate attention: the table identifies an affected release but directs administrators to the vendor advisory instead of naming a fixed version.

What to do now

1. Identify each device's exact model and complete firmware string, then match it to the vendor advisory. Preserve the letters, punctuation, and model suffixes when comparing versions. Follow the update steps in the vendor's advisory.
2. For CVE-2026-107441, the affected GS1900 releases and corresponding fixed releases are: GS1900-8, 2.90(AAHH.2)C0 and earlier → 2.90(AAHH.3)C0 and later; GS1900-8HP, 2.90(AAHI.2)C0 and earlier → 2.90(AAHI.3)C0 and later; GS1900-10HP, 2.90(AAZI.2)C0 and earlier → 2.90(AAZI.3)C0 and later; GS1900-16, 2.90(AAHJ.2)C0 and earlier → 2.90(AAHJ.3)C0 and later; GS1900-24, 2.90(AAHL.2)C0 and earlier → 2.90(AAHL.3)C0 and later; GS1900-24E, 2.90(AAHK.2)C0 and earlier → 2.90(AAHK.3)C0 and later; GS1900-24EP, 2.90(ABTO.2)C0 and earlier → 2.90(ABTO.3)C0 and later; GS1900-24HPv2, 2.90(ABTP.2)C0 and earlier → 2.90(ABTP.3)C0 and later; GS1900-48, 2.90(AAHN.2)C0 and earlier → 2.90(AAHN.3)C0 and later; GS1900-48HPv2, 2.90(ABTQ.2)C0 and earlier → 2.90(ABTQ.3)C0 and later.
3. For CVE-2026-76955, check these access point releases: IAP500BE, 7.40(ACPJ.1)C0 and earlier → 7.40(ACPJ.2)C0 and later; NWA110AX, 7.12(ABTG.0)C0 and earlier → 7.12(ABTG.1)C0 and later; NWA110BE, 7.40(ACLZ.1)C0 and earlier → 7.40(ACLZ.2)C0 and later; NWA130BE, 7.40(ACIL.1)C0 and earlier → 7.40(ACIL.2)C0 and later; NWA210AX, 7.12(ABTD.0)C0 and earlier → 7.12(ABTD.1)C0 and later; NWA210AXv2, 7.40(ACSR.1)C0 and earlier → 7.40(ACSR.2)C0 and later; NWA210BE, 7.40(ACLY.1)C0 and earlier → 7.40(ACLY.2)C0 and later; NWA220AX-6E, 7.12(ACCO.0)C0 and earlier → 7.12(ACCO.1)C0 and later; NWA240BE, 7.40(ACQG.1)C0 and earlier → 7.40(ACQG.2)C0 and later; NWA30BE, 7.40(ACPI.1)C0 and earlier → 7.40(ACPI.2)C0 and later.
4. Continue the CVE-2026-76955 comparison for these models: NWA50AX, 7.12(ABYW.0)C0 and earlier → 7.12(ABYW.1)C0 and later; NWA50AX PRO, 7.12(ACGE.0)C0 and earlier → 7.12(ACGE.1)C0 and later; NWA50BE, 7.40(ACPB.1)C0 and earlier → 7.40(ACPB.2)C0 and later; NWA50BE MAX, 7.40(ACTP.1)C0 and earlier → 7.40(ACTP.2)C0 and later; NWA50BE PRO, 7.40(ACPC.1)C0 and earlier → 7.40(ACPC.2)C0 and later; NWA55AX PRO, 7.12(ACSP.0)C0 and earlier → 7.12(ACSP.1)C0 and later; NWA55AX PTP, 7.12(ACSQ.0)C0 and earlier → 7.12(ACSQ.1)C0 and later; NWA55AXE, 7.12(ABZL.0)C0 and earlier → 7.12(ABZL.1)C0 and later; NWA55BE, 7.40(ACPH.1)C0 and earlier → 7.40(ACPH.2)C0 and later.
5. Check the remaining NWA entries for CVE-2026-76955: NWA90AX, 7.12(ACCV.0)C0 and earlier → 7.12(ACCV.1)C0 and later; NWA90AX PRO, 7.12(ACGF.0)C0 and earlier → 7.12(ACGF.1)C0 and later; NWA90BE, 7.40(ACPD.1)C0 and earlier → 7.40(ACPD.2)C0 and later; NWA90BE MAX, 7.40(ACTQ.1)C0 and earlier → 7.40(ACTQ.2)C0 and later; NWA90BE PRO, 7.40(ACPE.1)C0 and earlier → 7.40(ACPE.2)C0 and later.
6. For the WAX models affected by CVE-2026-76955, compare these releases: WAX300H, 7.12(ACHF.0)C0 and earlier → 7.12(ACHF.1)C0 and later; WAX510D, 7.12(ABTF.0)C0 and earlier → 7.12(ABTF.1)C0 and later; WAX610D, 7.12(ABTE.0)C0 and earlier → 7.12(ABTE.1)C0 and later; WAX620D-6E, 7.12(ACCN.0)C0 and earlier → 7.12(ACCN.1)C0 and later; WAX630S, 7.12(ABZD.0)C0 and earlier → 7.12(ABZD.1)C0 and later.
7. For WAC500H running 6.70(ABWA.7)C0 and earlier, see the vendor advisory for the required action for CVE-2026-76955. No fixed version is specified in the advisory table. After completing the applicable update or vendor-directed action, record the resulting firmware and remediation status for each device.

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to affected devices, particularly access from adjacent networks or the LAN.
• Check the vendor advisory for guidance on reducing internet exposure. Treat access restrictions as temporary risk reduction while arranging the applicable firmware update.

How to confirm the fix

• After the update, confirm the firmware actually running on each device matches its exact model's fixed release or a later applicable release. A downloaded firmware package alone does not confirm installation.
• Compare the complete firmware identifier with the advisory. For example, GS1900-24E should be on 2.90(AAHK.3)C0 and later, while NWA110AX should be on 7.12(ABTG.1)C0 and later.
• For WAC500H, confirm that the action specified in the vendor advisory has been completed; do not assume that a fixed release can be inferred from another model's version.
• Confirm expected network service after the update and retain the model, resulting firmware, and completed action in your maintenance records.

NVD scores and CISA KEV status

As of November 5, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 51 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Zyxel advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-out-of-bounds-write-vulnerability-in-gs1900-series-switches-11-03-2026
• Zyxel advisory: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-vulnerability-in-certain-aps-fwa7-and-security-routers-11-03-2026
• NVD: CVE-2026-107441
• NVD: CVE-2026-76955
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on November 5, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.