EUVD-2026-31603
GHSA-53r7-38m4-hpmp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the component POST Request Handler. Executing a manipulation of the argument sub_dir can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers to execute arbitrary OS commands by manipulating the sub_dir parameter of POST requests to the /goform/formUSBStorage endpoint. The vulnerability stems from unsanitized input passed directly to a system-level command in the formUSBStorage function (CWE-77). A public proof-of-concept exploit has been published, the vendor has not responded to disclosure, and no patch is available, leaving all known-affected deployments without an official remediation path.
Technical ContextAI
The Edimax BR-6675nD is a consumer/SOHO wireless router running an embedded web management interface. The vulnerable component is the formUSBStorage POST request handler at /goform/formUSBStorage, which processes USB storage configuration including directory paths. CWE-77 (Improper Neutralization of Special Elements used in a Command) describes the root cause: the sub_dir argument supplied via POST body is incorporated into an OS-level shell command without sanitization, allowing injection of shell metacharacters (e.g., semicolons, backticks, pipes) to chain or substitute arbitrary commands. The CPE string cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not constrained the scope to a single confirmed version beyond the 1.12 reported by EUVD-2026-31603, suggesting other firmware versions may carry the same flaw.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor did not respond to disclosure. Organizations using the Edimax BR-6675nD should immediately restrict access to the web management interface by binding it to a non-WAN-facing interface or placing it behind a firewall rule that allows only trusted management IPs. If USB storage functionality is not in active use, disabling it via the router's interface may reduce the exposed attack surface, though the underlying code path may still be reachable. Network segmentation - placing the router's management interface on a dedicated VLAN inaccessible from user-facing networks - is the most effective compensating control. Default and weak router credentials should be changed immediately, as PR:L exploitation relies on having any valid login. Replacing the device with a supported model from a vendor that actively patches embedded firmware is the recommended long-term remediation, given the vendor's non-response. Monitor VulDB (https://vuldb.com/vuln/365381) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-9400) for any future vendor patch releases.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today