EUVD-2026-31602
GHSA-r9fg-8xgr-43j8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in Edimax BR-6675nD 1.12. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component POST Request Handler. The manipulation of the argument ateFunc/ateGain/ateRate/ateChan/ateTxCount/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/ateTxFreqOffset/ateMode/ateMacID/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/readE2P/e2pTxPwDeltaN results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS commands by manipulating over two dozen POST parameters in the formWlanMP wireless calibration handler. The vulnerable endpoint exposes ATE (Automated Test Equipment) and EEPROM power calibration parameters - none requiring special configuration to be present - that pass user input unsanitized to a system-level command interpreter. A publicly available proof-of-concept exploit exists, no vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments permanently unmitigated absent compensating controls.
Technical ContextAI
The vulnerability resides in the formWlanMP function exposed at the CGI endpoint /goform/formWlanMP in the Edimax BR-6675nD 1.12 embedded router firmware. The affected POST parameters - including ateFunc, ateGain, ateRate, ateChan, ateTxCount, ateTxFreqOffset, ateMode, ateMacID, ateBW, ateAntenna, and a full suite of e2pTxPower and e2pTxPwDelta EEPROM calibration fields - are standard components of wireless manufacturing and testing interfaces (ATE = Automated Test Equipment), commonly present in consumer and SMB router firmware. CWE-77 (Improper Neutralization of Special Elements used in a Command) confirms that these parameters are concatenated into a shell command without sanitization or escaping, allowing shell metacharacters to break out of intended command context. The CPE string cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* uses a version wildcard, though only version 1.12 is explicitly confirmed in EUVD-2026-31602.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no fix version is confirmed from any source. As the primary mitigation, restrict access to the device's web management interface (/goform/ CGI endpoints) by disabling WAN-side remote administration if enabled, which eliminates internet-exposed attack surface at the cost of losing remote management capability. Place the device behind a firewall that blocks inbound access to HTTP/HTTPS management ports from untrusted networks. If network segmentation is available, isolate the router management VLAN from general user and guest traffic to prevent lateral exploitation from compromised internal hosts. Given the vendor's non-response and the device's apparent EOL status, replacing the BR-6675nD with an actively maintained router platform is the most durable remediation. Exploit details are documented at https://vuldb.com/vuln/365383 and the public POC at the Notion reference linked in VulDB CTI data.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today