CVE-2026-6837: Zyxel export-cgi PKCS#12 Command Injection

This repository packages the public writeup, quick verification script, and supporting evidence for CVE-2026-6837.

What this is

CVE-2026-6837 is a post-authentication command-injection flaw in Zyxel's export-cgi handler. On the category=pkcs12 branch, the handler builds a shell command from the certificate name and export password, then passes that string to system(). A crafted double quote in the password breaks out of the intended string and executes shell syntax.

The local reverse work in this repo was anchored on WAX650S V7.10(ABRM.4)C0, but Zyxel's 2026-08-04 advisory lists 18 affected AP models.

Files

• index.html: standalone public-facing HTML writeup
• writeup.md: markdown source for the writeup
• poc/reproduce.sh: lab verification script for the admin-authenticated command injection
• evidence/finding2_cmdi_transcript.txt: transcript showing the injected id output in the HTTP response
• evidence/firmware_identification.txt: firmware identification notes from the original report

Quick verification

chmod +x poc/reproduce.sh
./poc/reproduce.sh <device_ip> <admin_authtok> <certname>

Expected success signal:

uid=0 gid=0(root) groups=0(root)

Notes

• Authorized testing only.
• The target certificate name must already exist under the device's certificate store for the vulnerable path to execute.
• The original workspace also contains broader Zyxel research; this repo is intentionally narrowed to the CVE-2026-6837 evidence set.
• For the deeper emulation and rehosting path, see https://github.com/minanagehsalalma/zyxel-wax650s-research-notebook-public.