EUVD-2026-31652
GHSA-56x4-p9v5-x925
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. Performing a manipulation of the argument rootAPmac results in command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a crafted POST request targeting the formiNICbasic endpoint. The rootAPmac parameter - likely used for wireless bridging MAC address configuration - is passed unsanitized to a system-level command, allowing an authenticated attacker with low privileges to inject arbitrary OS commands. A public proof-of-concept exploit has been released; the vendor was notified but did not respond, leaving the vulnerability unpatched. While not listed in CISA KEV, the EPSS score of 0.84% at the 75th percentile and confirmed POC availability represent a meaningful risk for exposed devices.
Technical ContextAI
The Edimax BR-6478AC is a consumer-grade wireless router whose web management interface exposes a CGI-style handler at /goform/formiNICbasic, processing POST requests via the formiNICbasic function. The rootAPmac argument - intended to accept a MAC address for root access point configuration in wireless repeater or WDS mode - is not properly sanitized before being passed to an underlying shell command, satisfying CWE-77 (Improper Neutralization of Special Elements used in a Command). This root cause class allows injection of shell metacharacters (e.g., semicolons, backticks, pipes) that break out of the intended command context. CPE cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* covers the affected product line, with version 1.23 confirmed affected per EUVD-2026-31652. The web management interface is the attack surface, making this exploitable over any network path that can reach the admin panel.
RemediationAI
No vendor-released patch is available at time of analysis - Edimax did not respond to the researcher's disclosure attempt. The primary recommended mitigation is to disable or restrict access to the router's web management interface from untrusted networks: configure firewall rules or ACLs to block external access to the management port (typically TCP 80/443), and if remote management is not required, disable it entirely in the router's admin settings. This eliminates the network-accessible attack surface at the cost of remote administration capability. Additionally, change all admin credentials to strong, non-default passwords to raise the bar for the required PR:L authentication step - this does not eliminate the vulnerability but limits who can trigger it. The public POC is documented at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formiNICbasic-34b53a41781f808bbc45e8ca54f93dd1 and should be reviewed to understand the exact payload format. Monitor VulDB entry https://vuldb.com/vuln/365422 for any vendor response or patch release.
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corru
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today