Zyxel has announced the release of firmware updates addressing a significant command injection vulnerability identified as CVE-2026-6837. This flaw impacts 18 models of their wireless access points.
Vulnerability Details
The vulnerability resides in the export-cgi component, posing a risk where authenticated administrators could execute operating system commands on affected devices. The issue is linked to the PKCS#12 certificate export process, where the password parameter can be improperly handled within shell commands.
This flaw allows an attacker with administrator access to manipulate inputs, potentially escaping the intended command environment to execute additional commands.
Technical Analysis
In an in-depth analysis of the Zyxel WAX650S firmware version 7.10(ABRM.4)C0, it was discovered that the export-cgi constructs a command string with certificate-export parameters before forwarding it to the system shell. The design flaw permits shell metacharacters to modify the command structure, enabling root-level command execution due to the high privilege context of the CGI process.
The vulnerability, classified under CWE-78 for improper neutralization of special elements in commands, requires an attacker to first achieve admin-level access, making it a post-authentication risk. However, the implications are significant as it could lead to total device control if an admin account is compromised.
Response and Recommendations
Zyxel’s advisory dated August 4, 2026, lists firmware 7.12 builds as the resolution for the affected models, including the WAX650S, which should be updated to version 7.12(ABRM.0)C0.
Organizations should quickly identify affected Zyxel APs and apply the new firmware. It is crucial to ensure web-based management interfaces are not exposed to untrusted networks and to rotate privileged credentials if exposure is suspected. Network segmentation and device log reviews for unusual certificate-export activities are also recommended.
This vulnerability highlights the importance of avoiding shell command construction from user-controlled data. Developers are urged to utilize interfaces with strict input validation rather than dynamically assembling command strings.
