Edimax BR-6478AC CVE-2026-10166

The attacker must hold at least low-privilege authentication to the Edimax BR-6478AC web management interface, as confirmed by the CVSS vector PR:L - unauthenticated exploitation is not supported by available data. The vulnerable endpoint is specifically /goform/formWlbasic via HTTP POST, and the injection vector is the rootAPmac parameter associated with wireless basic or WDS/repeater configuration. The web management interface must be network-reachable from the attacker's position (AV:N); if restricted to LAN-only access, exploitation requires a foothold on the local network. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race conditions or special target states are needed. Exploitation is bounded by: the requirement for valid credentials (default or low-privilege), access to the management web interface, and the device running the affected firmware version 1.23. Consumer routers with default credentials or shared passwords materially reduce the authentication barrier.

The CVSS 3.1 score of 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates network-accessible exploitation requiring only low-privilege authentication, low attack complexity, and no user interaction, with partial impact across confidentiality, integrity, and availability. However, command injection on embedded router firmware typically yields a root-level shell in practice, making the partial CVSS impact scores likely understated relative to real-world consequences. The temporal modifier E:P (partial exploit) confirms public POC availability, directly elevating practical risk above the base score. EPSS data was not provided in source intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is not confirmed, meaning widespread active exploitation is not currently documented by CISA. The RC:R (reasonable) remediation confidence in the CVSS temporal vector reflects uncertainty around patch availability, which is consistent with the absence of a vendor advisory in the provided references. Overall, this warrants prioritization above its nominal score for any deployment where the management interface is network-accessible.

An attacker who has obtained low-privilege credentials to the Edimax BR-6478AC web interface - through credential stuffing, default credentials, or prior compromise - submits a crafted HTTP POST request to /goform/formWlbasic with a rootAPmac value containing shell metacharacters such as a semicolon followed by a reverse shell command. The router's web server passes the unsanitized value to a system-level call, executing the injected command in the context of the web server process, which on many embedded devices runs as root. A public proof-of-concept demonstrating this technique has been disclosed, meaning the attack does not require advanced expertise.