## https://sploitus.com/exploit?id=D8F7FACB-F5F9-558A-A08D-F0A42337381F
# CVE-2026-6837: Zyxel `export-cgi` PKCS#12 Command Injection
This repository packages the public writeup, quick verification script, and supporting evidence for `CVE-2026-6837`.
## What this is
`CVE-2026-6837` is a post-authentication command-injection flaw in Zyxel's `export-cgi` handler. On the `category=pkcs12` branch, the handler builds a shell command from the certificate name and export password, then passes that string to `system()`. A crafted double quote in the password breaks out of the intended string and executes shell syntax.
The local reverse work in this repo was anchored on `WAX650S V7.10(ABRM.4)C0`, but Zyxel's `2026-08-04` advisory lists `18` affected AP models.
## Files
- `index.html`: standalone public-facing HTML writeup
- `writeup.md`: markdown source for the writeup
- `poc/reproduce.sh`: lab verification script for the admin-authenticated command injection
- `evidence/finding2_cmdi_transcript.txt`: transcript showing the injected `id` output in the HTTP response
- `evidence/firmware_identification.txt`: firmware identification notes from the original report
## Quick verification
```bash
chmod +x poc/reproduce.sh
./poc/reproduce.sh
```
Expected success signal:
```text
uid=0 gid=0(root) groups=0(root)
```
## Notes
- Authorized testing only.
- The target certificate name must already exist under the device's certificate store for the vulnerable path to execute.
- The original workspace also contains broader Zyxel research; this repo is intentionally narrowed to the `CVE-2026-6837` evidence set.
- For the deeper emulation and rehosting path, see `https://github.com/minanagehsalalma/zyxel-wax650s-research-notebook-public`.