EUVD-2026-31593
GHSA-78xw-fxqw-mj3j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Edimax BR-6675nD 1.12. This impacts the function formWpsStart of the file /goform/formWpsStart of the component POST Request Handler. This manipulation of the argument pinCode causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege authentication to execute arbitrary OS-level commands by supplying unsanitized shell metacharacters in the pinCode POST parameter of /goform/formWpsStart. Publicly available exploit code exists, confirmed via a Notion-hosted proof-of-concept referenced in VulDB reporting. The vendor was notified prior to disclosure but did not respond, and no patch has been released - leaving affected deployments without a vendor-supported remediation path.
Technical ContextAI
The vulnerable component is the formWpsStart function within the /goform/formWpsStart POST request handler - part of the embedded web management interface on the Edimax BR-6675nD consumer wireless router. The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), which covers cases where user-controlled input containing shell special characters is passed into a command interpreter without sanitization. In embedded firmware environments, CWE-77 commonly results in OS-level command execution because these devices typically rely on lightweight shell interpreters (such as BusyBox sh) to process web form inputs via CGI-style handlers. The WPS (Wi-Fi Protected Setup) PIN entry process is the attack surface - the pinCode argument is processed by formWpsStart and passed unsanitized downstream. The CPE string cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* uses a wildcard version field in NVD, indicating the full affected version scope is not precisely bounded beyond the confirmed 1.12 firmware.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor was contacted prior to public disclosure and did not respond. As an immediate compensating control, administrators should disable WAN-side access to the router's web management interface to prevent remote exploitation from untrusted networks - note this does not mitigate attacks from within the LAN. Where WPS functionality is not required, disabling it via the management interface removes the vulnerable /goform/formWpsStart endpoint from the attack surface; however, it is unconfirmed whether disabling WPS in the UI fully prevents the underlying handler from accepting POST requests on this firmware version. Restricting access to the router's HTTP/HTTPS management ports (typically 80 and 443) using upstream firewall rules or ACLs reduces exposure to untrusted segments. Enforcing strong, non-default credentials limits the pool of attackers who can satisfy the PR:L requirement. Given the vendor's non-responsiveness, replacement with an actively maintained device from a vendor with a published security response policy is the definitive long-term resolution. The public PoC is documented at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formWpsStart-34b53a41781f8011b77ac5ebb77dfddd.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today