Edimax BR-6428NS CVE-2026-8777

Requires authenticated access to the Edimax BR-6428NS web management interface with low-level user privileges (PR:L). The attack targets the POST request handler at /goform/formStaDrvSetup, which must be accessible over the network. Exploitation is possible against default router configurations where the web management interface is enabled. No user interaction (UI:N) is required beyond the attacker's authenticated session. Limiting factors that reduce real-world risk: attackers must first obtain valid credentials through separate means (social engineering, default password exploitation, or prior compromise), and many organizations disable remote management access to router interfaces, restricting exposure to trusted internal networks only. If the web interface is restricted to local network access only, attackers require existing presence on the internal network.

Real-world risk is MODERATE despite public exploit availability. The CVSS base score of 6.3 reflects network-accessible attack vector with low complexity, but crucially requires low-privilege authentication (PR:L), significantly limiting the attack surface compared to unauthenticated flaws. The Exploit Maturity indicator (E:P) confirms proof-of-concept code exists publicly. However, EPSS data is not provided for context on probability of mass exploitation. The CVSS impact ratings (C:L/I:L/A:L) indicate limited confidentiality, integrity, and availability impact, though command injection on a router can enable network pivoting, traffic interception, or persistent backdoor installation beyond these base impacts. The primary risk factor is vendor unresponsiveness (RL:X indicating no official remediation level), meaning this vulnerability will remain indefinitely in deployed devices without community-developed patches. Organizations using this router model should prioritize replacement over attempting remediation, as the vendor's silence suggests end-of-life status. The authentication requirement means this is primarily a post-compromise pivot tool rather than an initial access vector, unless default/weak credentials are in use.

An attacker who has compromised low-privilege credentials (via phishing, credential stuffing against default passwords, or previous network breach) authenticates to the BR-6428NS web management interface. They craft a malicious POST request to /goform/formStaDrvSetup with shell metacharacters in the stadrv_ssid parameter, such as injecting backticks or semicolons followed by system commands. The router executes these commands, allowing the attacker to establish a reverse shell, modify routing tables to intercept traffic, or install persistent backdoor access for long-term network monitoring.