Zyxel Patches Command Injection Flaw in 18 Access Points Allowing Root OS Command Execution
Brief
Zyxel has released firmware updates for a high-severity command injection vulnerability, tracked as CVE-2026-6837, affecting 18 wireless access point models.
The flaw exists in the export-cgi component and could allow an authenticated administrator to execute operating-system commands on vulnerable devices.
The issue affects the PKCS#12 certificate export workflow. Security researcher Mina Nageh Salama reported that the certificate export password parameter could be inserted into a shell command without safe argument handling.
An attacker with a valid administrator session could abuse specially crafted input to escape the expected command context and run additional commands.
Technical analysis of Zyxel WAX650S firmware version 7. 10(ABRM. 4)C0 found that export-cgi built a command string containing certificate-export values before sending it to the system shell.