CVE-2026-6837-zyxel-export-cgi-command-injection

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection This repository packages the public writeup, quick verification script, and supporting evidence for CVE-2026-6837. What this is CVE-2026-6837 is a post-authentication command-injection flaw in Zyxel's export-cgi handler. On the...

CVE-2026-109109

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is...

CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is...

CVE-2026-109109

A stack-based buffer overflow vulnerability exists in the Settings Export CGI component of Wavlink WL-WN530BE1-A 251117 . The flaw resides in the strcpy function within the /cgi-bin/ExportAllSettings.cgi file, triggered by manipulating the HTTP_COOKIE/X-Cmd argument. This vulnerability can be exp...

PT-2026-111303

Name of the Vulnerable Software and Affected Versions Wavlink WL-WN530BE1-A version 251117 Description A stack-based buffer overflow exists in the Settings Export CGI component. The issue occurs within the strcpy function located in the '/cgi-bin/ExportAllSettings.cgi' endpoint when the HTTP...

CVE-2026-109109: Stack-based Buffer Overflow

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is...

Zyxel Firewall Auth Bypass (CVE-2022-0342)

Exploits CVE-2022-0342 in Zyxel USG/ZyWALL/ATP/VPN/NSG: unauthenticated export-cgi downloads startup-config.conf with admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel firewall export-cgi auth bypass CVE-2022-0342.""" from kittysploit import from lib.protocols.http.httpclient...

Exploit for CVE-2026-6837

CVE-2026-6837: Zyxel export-cgi PKCS12 Command Injection T...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

EUVD-2026-52566

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6837: Improper Neutralization of Special Elements used in an OS Command

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

PT-2026-67633

Name of the Vulnerable Software and Affected Versions Zyxel WAX650S versions prior to 7.10ABRM.4C0 Description A post-authentication command injection issue exists in the "export-cgi" CGI program. This allows an authenticated attacker with administrator privileges to execute arbitrary operating...

CVE-2024-6342: Improper Neutralization of Special Elements used in an OS Command

UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21AAZF.18C0 and NAS542 firmware versions through V5.21ABAG.15C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...

PT-2024-6387 · Zyxel · Zyxel Nas326 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions through V5.21AAZF.18C0 Zyxel NAS542 versions through V5.21ABAG.15C0 Description: A command injection vulnerability in the export-cgi program of Zyxel NAS326 and NAS542 firmware could allow an unauthenticated attacker to...

Zyxel NAS Export CGI Code Execution

The vulnerability of the export-cgi and fileupload-cgi implementations of the backup and configuration restoration functions for Zyxel NAS326 and Zyxel NAS542 network storage devices is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows an attacker to bypass...