Edimax BR-6675nD CVE-2026-9402

Exploitation requires the attacker to hold at minimum a low-privileged authenticated session on the Edimax BR-6675nD 1.12 web management interface, confirmed by CVSS PR:L. The /goform/formWlanMP endpoint must be network-reachable - either via LAN access or via WAN-exposed remote management (AV:N). No special non-default configuration is required to expose the vulnerable wireless ATE/EEPROM handler; it is a standard component of the firmware's web interface. Limiting factors: authentication (PR:L) prevents fully unauthenticated exploitation, and SSVC Automatable: no reflects this credential prerequisite. However, default or weak credentials on consumer-grade routers are a common real-world condition, substantially reducing the effective barrier. No specific OS, platform variant, or optional feature flag has been identified as an additional prerequisite beyond firmware version 1.12 and network reachability.

The CVSS 4.0 numeric score of 2.1 is misleadingly low given the attack vector profile: AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable exploitation requiring no interaction, no special attack conditions, and only low-level credentials. The low score is driven entirely by the low CIA impact ratings (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) and the E:P exploit maturity modifier - not by attack difficulty. For a command injection vulnerability in router firmware, this numeric score substantially understates real-world exploitability. EPSS at 0.84% (75th percentile) reflects a moderate relative probability of exploitation compared to all CVEs, consistent with a niche consumer device. No CISA KEV listing confirms no confirmed widespread active exploitation at time of analysis. The SSVC designation of Automatable: no aligns with the PR:L authentication prerequisite, but default or weak credentials on consumer routers are endemic, functionally lowering this barrier. The combination of a public POC, vendor non-response, no patch, and an EOL-class consumer device represents elevated sustained risk for any internet-exposed deployment.

An attacker who has obtained low-privileged credentials to the Edimax BR-6675nD web interface - whether through default credentials, credential stuffing, or a prior compromise - sends a crafted HTTP POST request to /goform/formWlanMP with shell metacharacters injected into a parameter such as ateFunc or e2pTxPower1. The firmware passes the unsanitized value directly into a system command, executing attacker-controlled OS commands in the firmware process context. A publicly available proof-of-concept hosted on Notion demonstrates this technique, significantly reducing the skill threshold for exploitation.