Is there a public PoC exploit available for CVE-2026-12809?

Yes, a public proof-of-concept exploit is available for CVE-2026-12809. Prioritise patching immediately. EPSS: 1.2%.

Edimax BR-6478AC V2 CVE-2026-12809

Q: What is the CVSS score of CVE-2026-12809?

CVE-2026-12809 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-38195 LOW

Command Injection (CWE-77)

2026-06-21 VulDB

GHSA-fqw2-w9cp-ggvm

Command Injection Br 6478Ac V2 Edimax

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible endpoint requires low-privilege auth; command injection yields full OS-level access so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:46 vuln.today

Severity Changed

Jun 21, 2026 - 22:37 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 22:37 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect of the component POST Request Handler. Such manipulation of the argument newpass leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privilege credentials to execute arbitrary OS commands by embedding shell metacharacters in the newpass argument of POST requests to the /goform/wiz_5in1_redirect endpoint. A public proof-of-concept exploit exists and is referenced in the VulDB disclosure, making this straightforwardly reproducible. The vendor has not responded to coordinated disclosure, leaving no official patch available - a significant concern for a SOHO network gateway that sits at the perimeter of home and small-office networks.

Technical ContextAI

The vulnerable component is the wiz_5in1_redirect function inside the embedded web management interface of the Edimax BR-6478AC V2 router (CPE: cpe:2.3:a:edimax:br-6478ac_v2:*:*:*:*:*:*:*:*). CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: user-supplied input from the newpass POST parameter is passed to a shell command without sanitization or escaping, allowing attackers to inject shell metacharacters (e.g., semicolons, backticks, pipe operators) that the underlying OS interprets as command delimiters. This is a textbook OS command injection pattern common in embedded Linux router firmware where web CGI handlers directly invoke shell utilities. The affected endpoint appears to belong to the setup wizard flow (wiz_5in1_redirect), suggesting it may be a configuration or credential-change handler.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, leaving no official fix available. As the primary compensating control, immediately restrict access to the router's web management interface so it is reachable only from trusted, internal IP addresses; block external (WAN-side) access to management ports (typically TCP 80 and 443) using upstream firewall rules or ACLs, which eliminates remote exploitation from untrusted networks. Where the management interface must remain accessible, enforce strong, unique credentials to raise the authentication barrier beyond the PR:L threshold. Consider disabling the setup wizard functionality (wiz_5in1_redirect endpoint) if the device's firmware allows selective feature restriction. Organizations dependent on this device for perimeter security should evaluate migration to a supported device model with an active security patch lifecycle, as an unpatched command injection vulnerability on a network gateway poses persistent, unresolved risk. Exploit details are publicly documented at the Notion reference linked from https://vuldb.com/vuln/372603.