Edimax BR-6675nD CVE-2026-9379

Exploitation requires two prerequisites: network reachability to the router's web management interface, and low-privilege authentication (PR:L per the CVSS 4.0 vector) - meaning the attacker must possess valid credentials, which could be default factory credentials (common on consumer routers), weak user-set passwords, or credentials obtained through a prior compromise. The specific attack surface is the /goform/formWpsStart POST endpoint's pinCode parameter, which is associated with the WPS PIN-entry functionality. This handler appears active by default in firmware version 1.12 - no non-default configuration is described as required to expose it. What limits exploitation: the attacker must clear the authentication step (PR:L), meaning unauthenticated exploitation is not indicated by the CVSS 4.0 vector; WAN-side exposure of the management interface is not default on all consumer routers and depends on deployment configuration. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms no user interaction is required after the authentication prerequisite is met and no special attack conditions (AT:N) are needed beyond basic network access.

The CVSS 4.0 score of 2.1 (Low severity) is driven by modest impact metrics - Vulnerable System Confidentiality, Integrity, and Availability are all rated Low (VC:L/VI:L/VA:L), with no impact on subsequent systems (SC:N/SI:N/SA:N). This low score is notable for a command injection vulnerability and may reflect the assessor's conservative view of what is accessible on the router's restricted OS environment; however, this impact assessment has not been independently confirmed by a vendor advisory and warrants scrutiny. Counterbalancing the low CVSS score, the attack vector is network-accessible (AV:N), requires no user interaction (UI:N), low complexity (AC:L), and only low privileges (PR:L). The EPSS score of 1.08% at the 78th percentile is a meaningful signal - this CVE is assessed as more likely to be exploited than approximately 78% of all known CVEs, despite the low absolute probability. Publicly available exploit code (E:P in CVSS 4.0 vector) further elevates practical risk. No CISA KEV listing exists, and no confirmed active exploitation has been reported - no public exploit identified beyond the PoC at time of analysis. The combination of a public PoC, no vendor patch, an unresponsive vendor, and an 78th-percentile EPSS rating makes this a higher operational priority than the raw CVSS score alone suggests, particularly for organizations with internet-exposed router management interfaces.

An attacker on the same network - or externally if the management interface is WAN-exposed - authenticates to the Edimax BR-6675nD web interface using default or weak credentials to satisfy the low-privilege requirement, then submits a crafted POST request to /goform/formWpsStart with a pinCode value containing shell metacharacters (e.g., semicolons or backticks). The firmware's formWpsStart function passes this value unsanitized to a shell interpreter, executing the attacker's injected commands with the privileges of the web server process. A public proof-of-concept demonstrating this technique is available, reducing the technical barrier for exploitation.