EIP-2026-100948

This exploit demonstrates an unauthenticated remote command execution (RCE) vulnerability in ZYCOO IP phone systems via the `/www/cgi-bin/system_cmd.cgi` endpoint. The `cmd` parameter is directly executed without authentication, allowing full system compromise.