EIP-2026-100725

The exploit demonstrates multiple command injection vulnerabilities in NexusWay devices via crafted HTTP requests to CGI scripts (e.g., `index.cgi`, `ping.cgi`, `nslookup.cgi`). The PoC uses shell metacharacters (`;`, `&&`) to chain arbitrary commands, achieving remote code execution (RCE) without authentication.