Edimax BR-6478AC CVE-2026-10127

Exploitation requires network access to the router's web administration interface (AV:N per CVSS) and low-privilege authentication (PR:L per CVSS) - the attacker must supply valid credentials to the device's HTTP-based management panel before reaching the vulnerable endpoint. The specific condition is submission of a POST request to /goform/formStaDrvSetup with a manipulated rootAPmac parameter value containing shell metacharacters. No user interaction is required beyond the attacker's own actions (UI:N). Exploitation is limited by: (1) the authentication requirement - unauthenticated attackers cannot reach the vulnerable handler; (2) exposure of the admin interface - devices with WAN-side management disabled are not remotely exploitable from the internet; (3) firmware version specificity - only version 1.23 is confirmed, though adjacent versions are unverified. The scope is unchanged (S:U), meaning the impact is confined to the router itself.

The CVSS 6.3 medium score reflects a meaningful but bounded attack surface: network reachable (AV:N), low complexity (AC:L), no user interaction required (UI:N), but requiring low-privilege authentication (PR:L), and with only partial impact across confidentiality, integrity, and availability (C:L/I:L/A:L, S:U). The authentication prerequisite is the primary limiting factor - an attacker must first obtain valid credentials, whether via default credentials, credential reuse, or a prior compromise. The temporal metrics elevate concern: E:P confirms a public proof-of-concept exists, RC:R indicates reasonable (though not vendor-confirmed) confidence, and RL:X signals no official remediation has been published. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The device is a SOHO router, a class frequently deployed with unchanged default credentials and internet-exposed admin panels, which substantially raises real-world exploitability above what the CVSS base score alone implies. No CISA KEV listing was present in the provided data.

An attacker who has obtained low-privilege credentials to the Edimax BR-6478AC admin interface - through default credential use, credential stuffing, or phishing - sends a crafted HTTP POST request to /goform/formStaDrvSetup with the rootAPmac parameter containing shell metacharacters and injected commands (e.g., rootAPmac=AA:BB:CC:DD:EE:FF;id). The router's CGI handler passes the unsanitized value directly to an OS command, executing the injected payload with the privileges of the web server process, commonly root on embedded Linux devices. A public proof-of-concept demonstrating this technique is available at the Notion page referenced in the CVE.