Is there a public PoC exploit available for CVE-2026-12807?

Yes, a public proof-of-concept exploit is available for CVE-2026-12807. Prioritise patching immediately. EPSS: 1.2%.

Edimax BR-6478AC V2 CVE-2026-12807

Q: What is the CVSS score of CVE-2026-12807?

CVE-2026-12807 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-38193 LOW

Command Injection (CWE-77)

2026-06-21 VulDB

GHSA-wj96-j9c9-gqpx

Command Injection Br 6478Ac V2 Edimax

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-accessible admin interface, PR:L for required authentication, scope changes because router compromise enables network-level interception, and command injection yields full OS access.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:45 vuln.today

Severity Changed

Jun 21, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 21:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The manipulation of the argument pppUserName/pptpUserName/L2TPUserName results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privileged web interface access to execute arbitrary OS commands by injecting shell metacharacters into WAN credential parameters submitted via POST to /goform/setWAN. A public proof-of-concept exploit is documented and available, the vendor did not respond to coordinated disclosure, and no patch exists - leaving only compensating controls as mitigation. No public exploit identified at time of analysis in CISA KEV, but the combination of public PoC, zero vendor response, and SOHO device deployment patterns represents materially elevated real-world risk.

Technical ContextAI

The Edimax BR-6478AC V2 is a SOHO dual-band wireless router. Its web-based administration interface exposes a CGI-style POST handler at /goform/setWAN, implemented by the setWAN function, which processes WAN interface configuration. Three input parameters - pppUserName (PPPoE), pptpUserName (PPTP), and L2TPUserName (L2TP) - are passed without sanitization into an OS-level command, satisfying CWE-77 (Improper Neutralization of Special Elements used in a Command). The CPE identifier cpe:2.3:a:edimax:br-6478ac_v2 scopes the affected product line to firmware version 1.23 per EUVD-2026-38193. Router firmware of this embedded class routinely runs all web server and CGI processes as root, meaning injected commands execute with full device privileges - a factor that makes the CVSS 4.0-provided impact ratings of VC:L/VI:L/VA:L appear inconsistent with the primitive and worth independent verification.

RemediationAI

No vendor-released patch is available at time of analysis - the vendor did not respond to disclosure. The primary action is to isolate the router's web administration interface: disable WAN-side remote management immediately if enabled, and restrict LAN-side admin access to specific trusted IP addresses using the router's access control features if available. Hardware replacement with an actively maintained device is the most durable fix given the absence of any patch path. If replacement is not immediately feasible, placing the router behind a perimeter device that blocks inbound access to port 80/8080 reduces external attack surface. Disabling PPTP and L2TP WAN protocol modes (using PPPoE or DHCP only) may eliminate two of the three vulnerable parameters, though PPPoE's pppUserName remains affected. Security teams can reference the public proof-of-concept at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-setWAN-34b53a41781f80b98c4be24d8cae61b1 to extract exact payload patterns for IDS/WAF detection rules - noting that blocking the specific endpoint /goform/setWAN at a perimeter WAF (if feasible) would prevent exploitation without affecting other device functions.