Loading vulnerability…
CVE-2026-6837 is a post-authentication command injection vulnerability in the export-cgi CGI program of Zyxel WAX650S firmware through version 7.10(ABRM.4)C0. The flaw is associated with the PKCS#12 certificate export flow, where attacker-controlled input is insufficiently sanitized before being incorporated into operating system command execution. A successful exploit allows an authenticated administrator to inject and execute arbitrary OS commands on the affected access point.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a real exploit/evidence package for CVE-2026-6837, an authenticated OS command injection in Zyxel export-cgi PKCS#12 export handling. The main exploit artifact is poc/reproduce.sh, a Bash PoC that sends an HTTPS request to /cgi-bin/export-cgi with category=pkcs12, a certificate name in arg0, and a quote-breaking payload in arg1. The payload x%22;id;echo%20COMMAND_INJECTION_CONFIRMED;# closes the intended quoted shell string and appends arbitrary shell commands. Successful exploitation yields in-band HTTP response output such as uid=0 gid=0(root), demonstrating root command execution. Repository structure is split between public documentation/evidence and a richer local emulation toolkit. README.md, writeup.md, index.html, and evidence/* explain the vulnerability, affected firmware, prerequisites, and transcript of successful exploitation. The emulation/ directory contains Bash and Python helpers for extracting Zyxel firmware, preparing a runnable rootfs, seeding SysV IPC objects, standing up fake AF_UNIX UAM services, and launching a local lighttpd-based lab on 127.0.0.1:8080. The run_admin_web_handler_focus.sh script specifically exercises export-cgi and file_upload-cgi in the emulated environment, including negative-control and quote-injection cases, and records artifacts. These emulation files support analysis and reproduction but are not the primary exploit delivered against a live target. Exploit capability: authenticated remote command execution as root against affected Zyxel AP web interfaces. Attack vector is web/network. Required conditions are an admin session token (authtok cookie) and an existing certificate object under the device certificate store so the PKCS#12 export branch reaches the vulnerable system() call. The repository does not contain a generalized post-exploitation framework; it is an operational PoC plus extensive reproduction infrastructure and evidence for the vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authenticated command-injection vulnerability in Zyxel's PKCS#12 certificate export flow.
A post-authentication command injection vulnerability in the export-cgi CGI program of certain Zyxel AP firmware versions that could let an authenticated administrator execute OS commands on the device.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.