Edimax BR-6478AC V2 CVE-2026-12807

The attack requires network reachability to the router's web administration interface - typically HTTP on port 80 or 8080, accessible from the LAN by default and potentially from the WAN if remote management is enabled. The CVSS 4.0 vector specifies PR:L, confirming that some authenticated access to the router interface is required; the attacker must be able to submit authenticated POST requests to /goform/setWAN. At least one WAN protocol mode (PPPoE via pppUserName, PPTP via pptpUserName, or L2TP via L2TPUserName) must be reachable through the form submission - it is unconfirmed from available data whether a specific WAN mode must be pre-selected or whether all three parameters are processed regardless. Exploitation is bounded by the authentication requirement (PR:L) and network access to the admin interface; LAN-restricted deployments with strong admin credentials and no WAN-exposed management significantly reduce risk. Default or weak credentials - common on SOHO devices - effectively collapse the authentication barrier.

The vendor-provided CVSS 4.0 vector scores 2.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P), which critically understates the realistic impact of OS command injection on embedded router firmware. Command injection on such devices typically yields root-level code execution, implying VC:H/VI:H/VA:H rather than VC:L/VI:L/VA:L as rated by VulDB - this discrepancy should be independently verified against the public PoC. No EPSS score was provided, and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation. However, the E:P threat metric in the CVSS 4.0 vector confirms a proof-of-concept is public, the vendor is unresponsive with no patch forthcoming, and SOHO routers are notorious for indefinite unpatched deployment. The authentication barrier (PR:L) is the primary limiting factor - this cannot be exploited without some access to the router's web interface - but default or weak credentials on SOHO devices make this barrier low in practice.

An attacker on the same LAN - or reaching the admin interface through an exposed WAN management port - authenticates to the Edimax BR-6478AC V2 web interface with low-privileged or default credentials, then submits a crafted POST request to /goform/setWAN with a shell payload embedded in the pppUserName field (e.g., value containing a semicolon-separated command). The setWAN handler passes the unsanitized string to a system-level call, executing the injected command - likely as root given typical embedded firmware architecture. The public proof-of-concept documents the exact technique, lowering the skill bar for exploitation significantly.