EUVD-2026-33470
GHSA-2rjv-9xvw-8pvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
AnalysisAI
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege credentials to execute arbitrary OS commands via the rootAPmac parameter in the formStaDrvSetup POST handler at /goform/formStaDrvSetup. The CVSS temporal vector confirms a public proof-of-concept (E:P) with reasonable confidence in the report (RC:R), while remediation level remains undefined (RL:X), indicating no vendor patch has been publicly acknowledged. No public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), but publicly available exploit code exists, elevating practical risk for deployed devices.
Technical ContextAI
The affected component is the formStaDrvSetup function within the embedded web server's POST request handler, located at the URI /goform/formStaDrvSetup. This endpoint is typical of SOHO router firmware built on embedded Linux platforms using CGI-style form handlers. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: the rootAPmac argument - intended to accept a MAC address of a root access point for station driver configuration - is passed to an OS command without proper sanitization or escaping of shell metacharacters. This allows an attacker to append or inject arbitrary shell commands. The CPE string cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD may not have constrained the vulnerable range beyond the 1.23 version confirmed by VulDB.
RemediationAI
No vendor-released patch has been identified at time of analysis - the CVSS remediation level RL:X and absence of any Edimax advisory confirm this. As compensating controls, administrators should immediately restrict access to the router's web administration interface to trusted internal IP addresses only, disabling remote (WAN-side) web management if enabled. Default credentials should be replaced with strong, unique passwords, as credential access is a prerequisite for exploitation (PR:L). Placing the device behind a firewall that blocks external access to the admin panel on ports 80 and 443 eliminates the network attack vector for external threat actors. Network segmentation that prevents untrusted LAN clients from reaching the admin interface further reduces exposure. Monitor VulDB entry https://vuldb.com/vuln/367304 and the Edimax security advisory page for patch availability. Note that disabling remote management does not protect against authenticated internal threat actors.
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corru
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today