Post-authentication command injection in Zyxel VMG3625-T50B TR-369 certificate download CGI

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-1459. It contains one executable script, CVE-2026-1459-shell.py, and a short README describing scope and affected firmware. The script is not part of a larger exploit framework. The exploit flow has two stages. First, it authenticates to the router's web interface using valid administrator credentials. To do this, it requests the router's RSA public key from /getRSAPublickKey, generates a random AES key and IV, encrypts the login payload with AES-CBC, encrypts the AES key with RSA PKCS#1 v1.5, and submits the encrypted login request to /UserLogin. It then decrypts the server response and extracts a session key used as a CSRF token. Second, it exploits a command injection vulnerability in /cgi-bin/TR369Certificates by sending a GET request with action=download and a malicious name parameter. The injected shell payload is x;echo root:{root_pass}|chpasswd;, which changes the root account password on the device. If successful, the operator can then SSH to the router as root using the supplied password. The README notes that this password change is temporary and resets on reboot. Repository structure is minimal and purpose-built: one Python script implementing crypto helpers, login logic, and exploitation logic; one README summarizing usage and affected targets. The exploit is operational rather than a mere detector because it performs authenticated exploitation and delivers a concrete post-exploitation outcome, but the payload is hardcoded to password change rather than being broadly customizable.