Edimax BR-6228NC CVE-2026-8774

Requires authenticated access with low-privilege credentials to the BR-6228NC web management interface. The vulnerability is exploitable against standard deployments where the web interface is network-accessible, which is typical for consumer router configurations. Exploitation does not require non-default settings or special feature enablement - the /goform/mp endpoint is part of normal device functionality. However, if remote administration is disabled or web interface access is restricted to specific management networks via firewall rules, external attackers cannot reach the vulnerable endpoint. Devices with unchanged default credentials face significantly higher risk as attackers commonly target routers with vendor default passwords. Physical network access or prior compromise of the local network removes all barriers to exploitation.

Real-world risk is moderate-to-high despite the CVSS base score of 6.3. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, though requiring low-privilege authentication reduces immediate attack surface compared to unauthenticated flaws. The E:P (Proof-of-concept) temporal metric confirms exploit code existence, which significantly elevates practical risk. The absence of vendor response (RL:X) means no official patch timeline exists, leaving devices perpetually vulnerable. For internet-facing routers with weak or default credentials, this becomes a high-priority concern as attackers commonly target IoT/router devices for botnet recruitment. The combination of public exploit, no vendor patch, and device class (consumer router often deployed with inadequate credential hygiene) suggests this will be integrated into automated exploitation frameworks. Organizations using this hardware in production environments face persistent risk until device replacement.

An attacker with network access to the router's web interface first authenticates using compromised low-privilege credentials (obtained via credential stuffing, default password exploitation, or prior compromise). They then send a crafted POST request to /goform/mp containing malicious shell commands in the 'command' parameter, such as downloading and executing a botnet client or establishing persistent reverse shell access. The vulnerable mp function executes these commands with the privilege level of the web server process, granting the attacker control over the router to intercept traffic, pivot to internal networks, or enroll the device in DDoS botnets.