Edimax BR-6428NS CVE-2026-9296

The CVSS PR:L vector confirms low-privilege authentication is required - the attacker must present valid credentials to the device's management interface. In practice, default Edimax credentials (commonly admin/1234 or similar, widely documented) satisfy this requirement, making exploitation functionally equivalent to unauthenticated on unmodified or factory-reset devices. The /goform/formWlanM endpoint must be reachable over the network (AV:N), which is the case when the management interface is exposed on the WAN interface or the attacker has LAN access. No user interaction is required (UI:N) and attack complexity is low (AC:L) - no race conditions or special timing required. Exploitation is confirmed against firmware version 1.10; other versions may be affected per the wildcard CPE but are not confirmed. What limits exploitation: devices with non-default, strong administrative credentials and management interfaces firewalled from untrusted networks are significantly harder to exploit.

The CVSS 6.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network-reachable, low-complexity exploitation requiring only low-privilege credentials, with confidentiality, integrity, and availability all partially impacted. The temporal metrics E:P (proof of concept exists) and RC:R (reasonable confidence, not yet vendor-confirmed) slightly temper the base score. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No CISA KEV listing is confirmed, meaning active widespread exploitation is not yet documented. However, the public exploit availability meaningfully elevates practical risk beyond what the 6.3 base score suggests: SOHO routers are routinely internet-exposed, Edimax devices frequently ship with well-known default credentials (which would satisfy the PR:L requirement and effectively reduce this to unauthenticated exploitation in practice), and the vendor's non-response to disclosure eliminates any near-term official remediation path. The CVSS score should be treated as a floor, not a ceiling, for prioritization purposes.

An attacker with network access to the Edimax BR-6428NS management interface - using default credentials (e.g., admin/1234) or previously obtained low-privilege credentials - sends a crafted HTTP POST request to /goform/formWlanM with shell metacharacters injected into a parameter such as ateFunc (e.g., ateFunc=;id;whoami;). The router firmware passes the unsanitized value to an internal system() or popen() call, executing the injected commands in the context of the router's embedded Linux OS process. A publicly available proof-of-concept hosted on Notion demonstrates this technique and reduces the attacker skill bar significantly.