Edimax BR-6478AC CVE-2026-9440

The vulnerable endpoint /goform/formAccept is part of the router's standard web administration interface and is active by default - no special non-default configuration is required to expose the vulnerable code path. Exploitation is gated by the authentication requirement confirmed by CVSS PR:L: the attacker must hold at minimum a low-privileged authenticated session on the web management interface before the injection is reachable. Unauthenticated remote attackers cannot directly exploit this flaw without first obtaining valid credentials. No user interaction is required beyond authentication (UI:N). If WAN-side remote management is enabled on the device, the attack surface extends to the internet; if management is LAN-only, exploitation is limited to network-adjacent or LAN-authenticated actors. The attack has no additional technical complexity requirements (AC:L, AT:N), meaning any authenticated user with HTTP access to the management interface can exploit it without special tooling beyond the documented POC.

The CVSS 4.0 score of 2.1 is notably low for a network-accessible command injection, driven entirely by all-Low confidentiality, integrity, and availability impact ratings (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) and the PR:L authenticated requirement - this creates a meaningful tension with the realistic severity of command injection on a router, which typically yields full device control. The low score may reflect a conservative scope assessment confined to the router's own context rather than the broader network. CVSS vector signals: attack is network-reachable (AV:N), low complexity (AC:L), no additional attack requirements (AT:N), no user interaction (UI:N), but requires low-level authenticated access (PR:L). The E:P modifier confirms POC maturity. EPSS at 0.84% (75th percentile) indicates moderate relative exploitation interest - above average but not mass-targeted. No KEV listing means CISA has not confirmed active exploitation. For defenders: the combination of public POC, unresponsive vendor, and no available patch materially elevates real-world risk beyond the 2.1 CVSS score. Organizations may deprioritize this due to the low score - that assessment should be revisited for any internet-facing deployment.

An attacker who has obtained low-privileged credentials to the Edimax BR-6478AC web interface - through credential stuffing, default password use, or prior compromise - sends a crafted HTTP POST request to /goform/formAccept with a submit-url value containing injected shell commands (e.g., submit-url=value;malicious_command). The router's CGI handler passes this unsanitized value to a system shell call, executing the attacker's commands with the firmware process's privileges. The public Notion-hosted proof-of-concept provides step-by-step reproduction details, meaning script-level attackers can execute this without deep technical knowledge.