EUVD-2026-31627
GHSA-c57r-97q9-v59j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6675nD 1.12. Impacted is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute arbitrary OS commands via the command argument in POST requests to the /goform/mp endpoint. Although a public exploit exists (referenced via a Notion-hosted POC), exploitation is constrained by the requirement for high-privilege authentication (CVSS PR:H), keeping the CVSS 4.0 score at 2.0 and EPSS at 0.23%. No vendor patch is available - the vendor did not respond to pre-disclosure contact - leaving devices persistently unmitigated at the firmware level.
Technical ContextAI
The Edimax BR-6675nD is a consumer/SOHO wireless router running embedded Linux firmware. Its web management interface exposes CGI-style form handlers under /goform/, a common pattern in budget embedded devices. The mp function in the POST request handler for /goform/mp fails to sanitize the command parameter before passing it to the underlying OS command interpreter - a textbook instance of CWE-77 (Improper Neutralization of Special Elements used in a Command). The CPE string cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* indicates NVD has not version-bounded the affected range beyond the disclosed 1.12, suggesting other firmware versions may be impacted. Embedded router web interfaces of this type typically run with elevated OS privileges, meaning injected commands execute at a privileged level.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was contacted prior to disclosure and did not respond, leaving no upstream fix available. The highest-impact compensating control is to immediately disable or restrict WAN-side access to the router's web management interface, preventing network-reachable exploitation by untrusted parties; note this does not protect against insider or LAN-based attackers. Firewall ACLs or the router's own access restriction features should be used to limit management interface access to specific trusted IP addresses only. Enforce strong, unique administrative credentials to raise the bar imposed by the CVSS PR:H authentication requirement - credential reuse or weak passwords are the primary path to meeting the prerequisite. If the device is internet-facing and no mitigating controls can be applied, replacement with a supported device from a responsive vendor should be considered, as the absence of a patch and vendor engagement represents an unresolvable long-term risk. References: VulDB entry https://vuldb.com/vuln/365404 and NVD advisory https://nvd.nist.gov/vuln/detail/CVE-2026-9423.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today