Root Shell via Cert Export: CVE-2026-6837 Hits 18 Zyxel AP Models
A password field in Zyxel's PKCS#12 certificate export lets an authenticated admin break into a shell command and execute as root across 18 enterprise AP models (CVE-2026-6837, CVSS 7.2). The write-up pairs a full AArch64 emulation rehost with an in-band exploit proof, and the fix lands in WAX650S 7.12(ABRM.0)C0.