Edimax BR-6478AC V2 CVE-2026-12810

The attack requires sending a POST request to /goform/mp on the Edimax BR-6478AC V2 running firmware 1.23. Per the CVSS 4.0 PR:L metric, low-privileged authentication to the router's web management interface is required - the attacker must have valid (even low-level) credentials for the web UI. No special non-default configuration is required beyond the router being reachable on its management interface. Exploitation is limited by: (1) the requirement for at least low-privilege authentication (PR:L), ruling out fully unauthenticated exploitation; (2) network reachability - the management interface is typically LAN-only by default, so WAN-side exploitation requires remote management to be explicitly enabled; (3) the specific firmware version 1.23 must be running. The vendor's non-response means no configuration-level mitigation has been officially documented.

The CVSS 4.0 base score of 2.1 is anomalously low for a network-accessible command injection flaw with a public PoC. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates low complexity and no special attack prerequisites beyond low-privilege authentication, which is alarming; however, the VC:L/VI:L/VA:L impact assessment is suspect - CWE-77 command injection in router firmware typically yields full root-level OS access. This discrepancy is not reconciled by the vendor (who did not respond) or by NVD. The public PoC documented on Notion elevates urgency. No CISA KEV listing exists, meaning exploitation is not confirmed as widespread, but the presence of a working exploit for a vendor-silent SOHO router with no patch makes this a realistic opportunistic target. Risk to organizations is primarily limited by network exposure: the router management interface is typically accessible only from LAN or specific management VLANs, not the WAN side by default, which substantially narrows the attack surface. EPSS data was not provided in the input - exploitation probability cannot be quantified. SSVC signals: exploitation is at PoC stage (not weaponized at scale), impact is potentially high if injection yields full shell, and the device class (SOHO router) means technical sophistication required is low. Net assessment: moderate-to-high priority for organizations running this specific firmware version, particularly given no vendor patch.

An attacker with low-privilege access to the Edimax BR-6478AC V2 web management interface - for example, a user on the same LAN segment with credentials to the router - sends a crafted POST request to /goform/mp with a manipulated command parameter containing shell metacharacters (e.g., semicolons, backticks, or pipe characters). The mp handler passes the unsanitized input to an OS-level command execution function, causing the injected command to run with the privileges of the web server process (typically root on embedded Linux routers). A public PoC hosted on Notion demonstrates this technique and lowers the skill bar for exploitation.