Zyxel GS1900-24E CGI out-of-bounds write leading to unauthenticated OS command execution

#!/usr/bin/env python3
"""Check Zyxel GS1900-24E firmware for CVE-2026-107441.
Outputs VULNERABLE, PATCHED, or UNKNOWN.
"""
import sys
import re
import urllib.request
import urllib.error

def get_body(url):
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    try:
        with urllib.request.urlopen(req, timeout=5) as resp:
            return resp.read(30000).decode('utf-8', errors='ignore')
    except Exception:
        return None

def extract_version(body):
    if not body:
        return None
    # Zyxel GS1900 web UI often displays firmware in the footer or about page
    patterns = [
        r'(?:Firmware Version|FW Version|Software Version)[^\d]{0,10}(\d+\.\d+\([^\)]+\))',
        r'(\d+\.\d+\([A-Z]+\.\d+\)C\d+)'
    ]
    for pat in patterns:
        m = re.search(pat, body, re.IGNORECASE)
        if m:
            return m.group(1)
    return None

def is_vulnerable(version):
    # Compare against vulnerable threshold 2.90(AAHK.2)C0.
    # We do a conservative parser: if the major/minor is lower, vulnerable;
    # if equal and build code is lexicographically <= 'AAHK.2', vulnerable.
    m = re.match(r'(\d+)\.(\d+)\(([^\)]+)\)C(\d+)', version)
    if not m:
        return False
    major, minor, build, cnum = int(m.group(1)), int(m.group(2)), m.group(3), int(m.group(4))
    if major < 2:
        return True
    if major == 2 and minor < 90:
        return True
    if major == 2 and minor == 90:
        # build code comparison: AAHK.2 vs AAHK.2; if lower => vulnerable
        if build < 'AAHK.2':
            return True
        if build == 'AAHK.2' and cnum <= 0:
            return True
    return False

def main():
    if len(sys.argv) != 2:
        print('Usage: python3 check_zyxel_gs1900.py <switch_ip>')
        sys.exit(2)
    ip = sys.argv[1]
    urls = [
        f'http://{ip}/',
        f'http://{ip}/index.htm',
        f'http://{ip}/cgi-bin/about.cgi',
        f'http://{ip}/web/version'
    ]
    found_version = None
    for url in urls:
        body = get_body(url)
        if body:
            ver = extract_version(body)
            if ver:
                found_version = ver
                break
    if not found_version:
        print('UNKNOWN: could not detect firmware version from web UI')
        sys.exit(3)
    print(f'Detected firmware: {found_version}')
    if is_vulnerable(found_version):
        print('VULNERABLE')
        sys.exit(0)
    else:
        # If version is above threshold, report PATCHED (manual validation still recommended)
        print('PATCHED')
        sys.exit(0)

if __name__ == '__main__':
    main()