Edimax BR-6478AC CVE-2026-12808

Exploitation requires low-privilege authenticated access (PR:L per the provided CVSS 4.0 vector) to the Edimax BR-6478AC V2 web management interface - specifically, the ability to submit POST requests to the /goform/stainfo endpoint with attacker-controlled values in the interface parameter. No special non-default configuration is required beyond possessing valid credentials. Exploitation is limited by this authentication requirement; however, the practical barrier is substantially reduced on SOHO routers where default credentials (admin/admin or similar) remain common. Remote network exploitation is possible if the router's management interface is exposed on the WAN interface, which is non-default on most SOHO routers but occurs due to misconfiguration; LAN-side exploitation is the more common path. No specific OS, browser, or feature toggle condition is documented as a prerequisite beyond authentication.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L) yields a score of 2.1 - a figure that conflicts sharply with the typical real-world impact of command injection on embedded Linux firmware, where full root shell access is the expected outcome. This discrepancy is unexplained in the available data and may reflect a reporter-applied conservative impact estimate; security teams should treat the 2.1 score with skepticism and independently assess impact. There is no CISA KEV listing, so confirmed widespread active exploitation is not established, and no EPSS data was provided. However, the existence of a public POC exploit (E:P in the CVSS 4.0 supplemental data) significantly raises real-world risk, and the PR:L authentication requirement - while a meaningful barrier in principle - is effectively reduced on SOHO devices that commonly retain default or weak credentials. The complete absence of a vendor patch, with no vendor response to disclosure, means all deployed BR-6478AC V2 units running firmware 1.23 remain permanently unmitigated without third-party action.

An attacker who has obtained low-privilege authenticated access to the BR-6478AC V2 web management interface - either through default credentials, credential stuffing, or prior lateral movement - sends a crafted POST request to /goform/stainfo with a payload such as interface=eth0;id; or a reverse-shell command embedded via shell metacharacters in the interface parameter. The stainfo CGI handler passes the unsanitized value directly to a system call, executing arbitrary OS commands with the privileges of the web process (typically root on embedded Linux). A public proof-of-concept documenting the exact exploitation method is available at the Notion page referenced in VulDB entry 372602, further lowering the skill barrier for exploitation.