Zyxel Patches Critical Command Injection Flaw in 18 Access Point Models
Zyxel has released firmware updates to address CVE-2026-6837, a critical command injection vulnerability affecting 18 wireless access point models, allowing root OS command execution.
Zyxel has issued critical firmware updates to mitigate CVE-2026-6837, a command injection vulnerability impacting eighteen of its wireless access point models. The flaw resides within the export-cgi component, a part of the PKCS#12 certificate export workflow. Successful exploitation requires an attacker to already possess administrator-level credentials for the affected device, but once achieved, it allows for the execution of arbitrary operating-system commands with root privileges.
The vulnerability was discovered by security researcher Mina Nageh Salama, who detailed how the certificate export password parameter could be manipulated. By crafting specific input, an attacker could bypass safe argument handling and inject shell metacharacters. This allows the command to break out of its intended context and execute additional, malicious commands on the access point. The CGI process, which handles these requests, operates with high privileges, meaning any successful exploit could lead to a complete compromise of the device.
NVD classifies this vulnerability as CWE-78, indicating improper neutralization of special elements used in an operating-system command. The post-authentication nature of the flaw means an attacker must first gain administrative access. This could be achieved through various means, such as compromised credentials, exposed management interfaces, or insider threats. Once administrative access is obtained, the vulnerability provides a direct path to full device takeover.
Researchers successfully reproduced a proof-of-concept for this vulnerability using an emulated Zyxel WAX650S firmware environment. The analysis involved extracting firmware, utilizing emulation tools like qemu-aarch64-static and Bubblewrap, and recreating the web-handler environment. This allowed for detailed observation of the Lighttpd and export-cgi request paths and the command output returned via HTTP responses.
The eighteen affected Zyxel access point models include NWA50AX, NWA50AX PRO, NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA90AX, NWA90AX PRO, NWA110AX, NWA210AX, NWA220AX-6E, WAX300H, WAX510D, WAX610D, WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, and WAX655E. Zyxel's advisory recommends updating to firmware version 7.12 builds, with specific mention of version 7.12(ABRM.0)C0 for the WAX650S model.
Organizations deploying these Zyxel access points are urged to promptly identify all affected devices and apply the necessary firmware updates. Beyond patching, it is crucial to secure management interfaces by ensuring they are not exposed to untrusted networks. Limiting management access through network segmentation and rotating privileged credentials where exposure is suspected are also recommended security practices. Reviewing device logs for any unusual certificate-export activity can aid in detecting potential compromise.
The underlying security principle highlighted by this vulnerability is the danger of constructing shell commands directly from user-controlled input. Developers are strongly advised to utilize safer, non-shell execution interfaces that properly separate arguments and enforce strict input validation, rather than relying on dynamic command string assembly with quoting mechanisms.