What is the CVSS score of CVE-2026-36734?

CVE-2026-36734 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of EDIMAX BR-6428nS V3 are affected by CVE-2026-36734?

EDIMAX BR-6428nS V3 wireless routers running firmware 1.15 are vulnerable to authenticated command injection that allows attackers to completely compromise the device, intercept network traffic, and…

How to fix or mitigate CVE-2026-36734?

Within 24 hours: Audit network topology to identify all BR-6428nS V3 routers running firmware 1.15 and document their connectivity and access controls. Within 7 days: Implement network segmentation and firewall rules to restrict management interface access (HTTP/HTTPS admin ports) to authorized administrator IP ranges only; disable remote management if enabled. Within 30 days: Contact EDIMAX support to confirm patch timeline; evaluate replacement with alternative router models that have active vendor support and security patching commitment.

EDIMAX BR-6428nS V3 CVE-2026-36734

EUVD-2026-29203 HIGH

Command Injection (CWE-77)

2026-05-11 mitre

GHSA-c9c6-xfr6-q42w

Command Injection N A

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 16:30 vuln.today

CVSS changed

May 12, 2026 - 14:22 NVD

8.8 (HIGH)

CVE Published

May 11, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker is able to execute arbitrary system commands on the device.

AnalysisAI

Command injection in EDIMAX BR-6428nS V3 wireless router firmware 1.15 allows authenticated attackers to execute arbitrary system commands via crafted input to WLAN configuration interface. The vulnerability requires low-privilege network authentication but no user interaction, enabling complete device compromise including credential theft, traffic interception, and pivot attacks into connected networks. EPSS score of 0.17% suggests low probability of mass exploitation, though a proof-of-concept is publicly available on GitHub, lowering the barrier for targeted attacks against exposed management interfaces.

Technical ContextAI

This vulnerability affects the WLAN configuration module in EDIMAX BR-6428nS V3 router firmware version 1.15. The root cause is CWE-77 (Command Injection), where the device fails to properly sanitize user-supplied input before passing it to system shell commands. When processing WLAN configuration parameters, the firmware likely concatenates user input directly into shell commands without validation, allowing shell metacharacters to break out of intended command structure. This is a common vulnerability class in embedded network devices where web interfaces invoke system utilities through shell wrappers. The CPE data from NVD is incomplete (showing 'n/a'), but the CVE description and vendor reference clearly identify the specific product model and firmware version affected.

RemediationAI

EDIMAX has not released public vendor security advisories or confirmed patched firmware versions at the time of analysis based on available references. Users should immediately check the EDIMAX support website (http://edimax.com) for firmware updates newer than version 1.15 and apply them if available. As interim compensating controls with specific trade-offs: (1) Disable remote administration features and restrict management interface access to trusted local networks only via firewall rules - this prevents internet-based exploitation but requires physical or VPN access for legitimate administration; (2) Change default administrative credentials to strong unique passwords - reduces but does not eliminate risk if attackers have network access; (3) Implement network segmentation to isolate the router's management VLAN from production networks - contains post-exploitation lateral movement but adds configuration complexity; (4) Monitor router logs for unusual WLAN configuration changes or command execution patterns - provides detection not prevention and requires log forwarding infrastructure. Organizations with critical security requirements should consider replacing affected devices with alternative routers that receive active security support, as this is an end-of-life consumer product with uncertain vendor support commitment.