Edimax BR-6478AC CVE-2026-9441

Exploitation requires low-level authenticated access to the router's web management interface, as confirmed by PR:L in the CVSS 4.0 vector - an attacker must possess valid credentials before the vulnerable endpoint can be reached. Network access to the device's web management port is required (AV:N), which is the default-enabled admin interface on the LAN and potentially exposed on the WAN if remote management is enabled. The specific vulnerable parameter is rootAPmac within a POST request to /goform/formiNICbasic, meaning only that specific endpoint and argument trigger the injection. Exploitation is not automatable per SSVC assessment, likely because credential acquisition must precede the exploit step. Limiting factors include: the authentication prerequisite (PR:L), the targeted single endpoint, and the fact that default router configurations often restrict management interface access to LAN-side hosts - WAN-exposed instances represent the highest-risk deployment scenario.

The CVSS 4.0 score of 2.1 appears low, driven entirely by the limited impact metrics - all confidentiality, integrity, and availability impacts on the vulnerable system are rated Low, with no scope change to subsequent systems (SC:N/SI:N/SA:N). However, this score understates real-world concern in several ways: the attack vector is Network (AV:N), complexity is Low (AC:L), no additional preconditions exist (AT:N), and no user interaction is required (UI:N) - only low-level authentication is needed (PR:L). The E:P modifier confirms a proof-of-concept is incorporated into the score. SSVC assessment aligns with partial technical impact and non-automatable exploitation, consistent with a credential requirement limiting mass scanning utility. EPSS at 0.84% (75th percentile) suggests this CVE is more likely to be exploited than roughly three-quarters of all CVEs, despite the low absolute probability. The absence of a vendor patch and the confirmed public POC are the most operationally significant risk elevators. The device class - a consumer/SMB router - is historically underpatched and often internet-exposed, compounding real-world risk beyond what CVSS alone conveys.

An attacker with valid low-privilege credentials to the Edimax BR-6478AC web management interface sends a crafted HTTP POST request to /goform/formiNICbasic, inserting shell metacharacters (e.g., a semicolon followed by a command) into the rootAPmac parameter value. The router's formiNICbasic function passes this unsanitized input to an OS-level command, executing the injected payload in the device's shell context. A public POC documenting this exact technique is available, reducing the skill barrier required to replicate the attack.