/writeups Research archive
16 technical writeups published between 2025 and 2026. 8 document a vulnerability that was assigned a CVE; the rest are experiments, reversing notes and research that never needed an identifier.
The features I added to the custom firmware on my USG FLEX 100H: an attack map, a honeypot that bans attackers automatically, automations and some smaller tools. It is a personal research build and is not available.
I added Cloudflare Tunnel to the custom firmware on my USG FLEX 100H, with its own page in the VPN menu, and opened a feature request on the Zyxel Community to ask whether uOS should have it natively.
Two Zyxel tools I use all the time only ran on Windows, and I work from Linux. I reverse engineered both and rewrote them for Linux, one Python file each.
The UaniaBOX hands its admin a web GUI and no shell. Its packet capture page validated the one field that looked dangerous, then handed me arbitrary file reads and writes over UBUS. One writable path, /etc/firewall.user, was enough to run commands as root.
A critical vulnerability in Zyxel firewalls, allows remote command execution with root privileges through improper input sanitization in the Dynamic DNS (DDNS) configuration. By injecting shell commands into a user-controlled URL parameter, an authenticated attacker can exploit the internal execution of curl to achieve full system compromise.
An undocumented parameter of the "web-auth" command could allow an authenticated attacker to execute commands remotely due to improper input sanitization, potentially resulting in full device compromise.
A vulnerability in the zysh-cgi component of the USG/ATP Series allows a low-privileged, semi-authenticated attacker to access the device’s configuration, bypassing authorization controls. This issue arises due to missing authorization checks and an incomplete validation of disallowed inputs, enabling the attacker to interact with restricted system functionalities through crafted requests. Successful exploitation may lead to exposure or modification of sensitive configuration data, even when two-factor authentication is enabled for the compromised account.
As part of a research project on prompt injection and AI security, the behavior of Zyxel’s Nebula AI chatbot was analyzed. The objective was to evaluate whether the model could be manipulated into disclosing internal information or metadata not intended for end-users.
An in-depth walkthrough of how a flawed file upload mechanism in Zyxel’s cloud migration service allowed arbitrary PHP file upload and execution, leading to full remote code execution on the backend infrastructure.
The incorrect permission assignment vulnerability in the PostgreSQL commands of certain USG FLEX H series uOS firmware versions could allow an authenticated local attacker with low privileges to gain access to the Linux shell and escalate their privileges by crafting malicious scripts or modifying system configurations with administrator-level access through a stolen token.
This writeup explain how to gain a remote code execution vulnerability in the ZLD product series. The vulnerability could allow attackers to execute arbitrary code on the target system.
This writeup covers the solution to a reverse engineering challenge from a recent CTF competition. The challenge required participants to reverse engineer a binary and find the flag.
During our ZLD assessment, we found a vulnerability to OS Command Injection that could allow attackers to compromise the entire device.
I found a privilege escalation vulnerability in the WBE product series, allowing unauthorized administrative access under certain conditions.
During my audit, I discovered that a user with a 'limited-admin' account could access sensitive system files and extract data such as passwords, emails, and user access tokens, or even compromise the system causing a denial of service.
My website is finally live! It will be the hub for my research, vulnerability disclosures, and security reports.