Edimax BR-6478AC V2 CVE-2026-12809

Exploitation requires two concrete prerequisites: (1) network-level access to the Edimax BR-6478AC V2 web management interface - if the interface is only accessible from the LAN, exploitation is limited to internal attackers or devices already on the local network; and (2) valid low-privilege credentials for the management interface (PR:L per the CVSS 4.0 vector), meaning a successful login session must be established before the malicious POST request can be submitted to /goform/wiz_5in1_redirect. The primary factor limiting exploitation is the authentication requirement - devices using strong, unique passwords are materially harder to exploit than those using default or weak credentials common in SOHO deployments. Exploitation is entirely blocked if the management interface is not exposed to untrusted networks. No specific non-default configuration, operating system, or feature flag is required beyond the device running firmware version 1.23 with a network-accessible management portal.

The provided CVSS 4.0 score of 2.1 with impact metrics VC:L/VI:L/VA:L is notably and unusually conservative for a command injection vulnerability - this assessment appears to undervalue the realistic impact of arbitrary OS command execution on a network gateway device. Command injection on embedded Linux router firmware typically yields root-level or high-privilege process access, enabling full device compromise, credential harvesting from the configuration store, persistent backdoor installation, and use of the device as a pivot point for lateral movement. The PR:L requirement is a genuine mitigating factor that limits the attack surface compared to unauthenticated flaws, but SOHO devices frequently operate with weak or default credentials, substantially lowering this barrier in practice. A public proof-of-concept exploit exists (CVSS 4.0 E:P), meaning this is not theoretical - the attack is demonstrably reproducible. The vulnerability is not listed in the CISA KEV catalog at time of analysis, indicating no confirmed widespread exploitation, but the combination of a network-facing target, public exploit, and absent vendor patch makes this a meaningful priority for any deployment where the management interface is reachable from untrusted networks.

An attacker who has obtained low-privilege credentials to the Edimax BR-6478AC V2 management interface - whether through credential stuffing, default password use, or prior phishing - sends a crafted HTTP POST request to /goform/wiz_5in1_redirect with a payload such as newpass=password;id; or similar shell-injection syntax. The router's CGI handler passes the unsanitized newpass value to a system shell call, executing the injected command in the context of the web server process. A public proof-of-concept on Notion (referenced from VulDB) documents this technique, meaning an attacker requires minimal skill to reproduce the attack.