Is there a public PoC exploit available for CVE-2026-12808?

Yes, a public proof-of-concept exploit is available for CVE-2026-12808. Prioritise patching immediately. EPSS: 1.2%.

Edimax BR-6478AC CVE-2026-12808

Q: What is the CVSS score of CVE-2026-12808?

CVE-2026-12808 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-38194 LOW

Command Injection (CWE-77)

2026-06-21 VulDB

GHSA-jjp3-xfgf-mr9p

Command Injection Br 6478Ac V2 Edimax

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible command injection requiring only low-privilege router credentials realistically yields full root shell access, warranting C:H/I:H/A:H rather than the reporter's Low ratings.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:45 vuln.today

Severity Changed

Jun 21, 2026 - 21:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 21:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in Edimax BR-6478AC V2 1.23. This impacts the function stainfo of the file /goform/stainfo of the component POST Request Handler. This manipulation of the argument interface causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Edimax BR-6478AC V2 router (firmware 1.23) allows authenticated remote attackers to execute arbitrary OS commands by manipulating the interface argument in POST requests to /goform/stainfo. No patch is available - Edimax did not respond to coordinated disclosure - and a public proof-of-concept exploit exists, making this a persistent, unmitigated risk on deployed devices. The vendor-reported CVSS 4.0 score of 2.1 appears to significantly understate actual impact, as unrestricted command injection on embedded router firmware typically enables full system control rather than merely low-severity limited access.

Technical ContextAI

The vulnerability resides in the stainfo function within the /goform/stainfo POST request handler of the Edimax BR-6478AC V2 (CPE: cpe:2.3:a:edimax:br-6478ac_v2:*:*:*:*:*:*:*:*), a SOHO dual-band wireless router. The goform endpoint pattern is characteristic of embedded CGI-style web management interfaces common in Realtek- and MediaTek-based router firmware, where POST parameters are frequently passed directly to shell utilities for network diagnostics. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the interface POST parameter is concatenated into a system-level shell command without adequate sanitization or metacharacter escaping. This class of flaw is endemic in SOHO router firmware and, when reached, typically provides direct shell access to the underlying Linux-based OS running as root.

RemediationAI

No vendor-released patch has been identified at time of analysis - Edimax did not respond to coordinated disclosure and no fixed firmware version is known. As an immediate compensating control, disable remote (WAN-side) management access to the router's web interface if it is exposed externally, reducing the attack surface to LAN-only access; note this does not eliminate the vulnerability but removes the most accessible attack vector. Enforce strong, unique administrator credentials on the device to raise the effective exploitation barrier beyond the PR:L threshold; default credentials make the PR:L requirement trivially satisfied. Apply network segmentation to isolate the router management VLAN from general user networks. If asset criticality justifies it, replacing the device with a vendor-supported model that has an active security response program is the recommended permanent resolution, as no patch timeline exists. Reference: VulDB advisory https://vuldb.com/vuln/372602; NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-12808.