Edimax BR-6675nD CVE-2026-9439

The CVSS 4.0 vector specifies PR:L (low privileges required), meaning the attacker must hold valid low-privilege credentials to the router's web management interface - unauthenticated exploitation is not supported by the available CVSS data. AV:N (network attack vector) requires network-level reachability to the management interface; restricting management access to LAN-only or a VPN segment substantially limits the exposed attack surface. The specific injection point is the interface parameter submitted to the /goform/stainfo endpoint - no special non-default router configuration beyond a reachable management interface is required. SSVC Automatable:no indicates that credential acquisition introduces a manual step, limiting mass automated exploitation. Exploitation is confirmed only against firmware version 1.12; other firmware versions are neither confirmed vulnerable nor cleared.

The CVSS 4.0 base score of 2.1 is strikingly low for a command injection vulnerability and warrants scrutiny. The score is suppressed by PR:L (low privileges required) and uniformly low impact subscores (VC:L/VI:L/VA:L), which appear to reflect a constrained impact scope rather than exploitation difficulty. The CVSS 4.0 E:P supplemental metric confirms a proof-of-concept exists, consistent with the publicly disclosed exploit. EPSS stands at 0.84% raw probability but at the 75th percentile, indicating this CVE attracts more real-world interest than the vast majority of published CVEs but has not reached mass-exploitation scale. SSVC assessment of Automatable:no and Technical Impact:partial aligns with the constrained CVSS impact ratings, suggesting manual credential acquisition limits automated abuse. This CVE is not listed in CISA KEV, and no confirmed in-the-wild exploitation beyond POC is supported by the available data. Despite the low CVSS score, command injection flaws on network-accessible router management interfaces carry meaningful operational risk - particularly when a POC is public and no vendor patch exists - and should not be dismissed on score alone.

An attacker who has obtained low-privilege credentials to the Edimax BR-6675nD management interface - for example via default credentials, credential reuse, or credential theft - submits an HTTP request to /goform/stainfo with the interface parameter containing injected shell metacharacters and commands. The router firmware passes this value directly to an OS-level command interpreter without sanitization, executing the injected payload with the privileges of the web server process. Because a working proof-of-concept is publicly available on Notion, any actor with valid router credentials can replicate this attack with minimal technical skill.