Is there a public PoC exploit available for CVE-2026-9440?

Yes, a public proof-of-concept exploit is available for CVE-2026-9440. Prioritise patching immediately. EPSS: 0.8%.

Edimax BR-6478AC CVE-2026-9440

Q: What is the CVSS score of CVE-2026-9440?

CVE-2026-9440 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-31651 LOW

Command Injection (CWE-77)

2026-05-25 VulDB

GHSA-pw48-m69f-6jgc

Command Injection Br 6478Ac

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:24 vuln.today

Severity Changed

May 26, 2026 - 19:37 NVD

MEDIUM LOW

CVSS changed

May 26, 2026 - 19:37 NVD

6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formAccept of the file /goform/formAccept of the component POST Request Handler. Such manipulation of the argument submit-url leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into the submit-url argument at /goform/formAccept. A public proof-of-concept exploit is documented via a Notion writeup, lowering the bar for exploitation; the vendor did not respond to responsible disclosure, leaving no patch available. No public exploit identified at time of analysis conflicts with KEV status - active exploitation is not confirmed by CISA, but EPSS at 0.84% (75th percentile) signals above-average relative exploitation interest given the public POC.

Technical ContextAI

The Edimax BR-6478AC is a consumer/SOHO wireless router running embedded Linux firmware. The vulnerable component is the formAccept CGI handler, accessible via HTTP POST to /goform/formAccept - a pattern common in embedded router web servers where CGI functions directly invoke shell commands with user-supplied input. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning the submit-url POST parameter is concatenated into a shell command without sanitization, permitting shell metacharacter injection (semicolons, backticks, pipes) to break context. The CPE identifier cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* covers this product family as catalogued by NVD. This vulnerability class is endemic to legacy router firmware where input validation is absent at the CGI layer.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the security researcher's disclosure, and no patched firmware version is referenced in any available source. As an immediate compensating control, disable WAN-side remote management on the router to prevent internet-facing exposure, restricting the attack surface to authenticated LAN-side users only; this mitigates network-reachable exploitation from external attackers but does not eliminate risk from compromised internal hosts. Enforce strong, unique credentials on the web administration interface, since PR:L requires at minimum low-privileged access - eliminating weak or default credentials raises the exploitation bar. Consider network-level access controls (e.g., firewall rules restricting HTTP access to the router's management port to a specific management VLAN or host) as an additional layer. Given the vendor's non-response, long-term remediation should include device replacement with a supported model receiving active security updates. Monitor VulDB (https://vuldb.com/vuln/365421) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-9440) for any future patch announcement.