Edimax BR-6428nC CVE-2026-96892

Exploitation requires reaching the device's web management interface (goform handler / websRedirect function) and, crucially, tricking a victim into clicking a crafted link containing a malicious submit-url value (UI:P) - the flaw cannot be triggered server-side without a victim's browser following the redirect. No authentication is required (PR:N) and it works against default firmware (version 1.16), but practical impact is limited to redirecting a user's browser to an attacker-chosen destination (phishing/social-engineering enabler), not direct device or data compromise. Effective exploitation typically also assumes network reachability of the router's HTTP interface (LAN, or WAN if remote management is exposed).

This is a genuine but low-priority issue. The CVSS 4.0 base score is 5.3 (MEDIUM), driven entirely by a limited integrity impact (VI:L) from an open redirect (CWE-601) - there is no confidentiality (VC:N) or availability (VA:N) impact. The vector is network-reachable and unauthenticated (AV:N/AC:L/AT:N/PR:N) but critically requires user interaction (UI:P), meaning a victim must click an attacker-crafted link, which is the primary friction limiting exploitation. Exploitation status is 'publicly available exploit code exists' (VulDB E:P plus a published notion.site write-up), but this is NOT active exploitation - there is no CISA KEV listing and no EPSS score provided, so real-world exploitation appears opportunistic/low-value rather than automated or widespread. Signals are consistent, not conflicting: a public PoC for a low-impact phishing-enabler on a niche consumer router. Realistically this is a high-CVSS-relative-to-actual-danger case - open redirects are chiefly useful as phishing/credential-harvesting stepping stones, not for direct compromise. Note the vendor did not respond and no patch exists, so exposure is unmitigated for affected devices.

An attacker crafts a URL to the BR-6428nC's goform handler with a malicious submit-url argument pointing to an attacker-controlled site, then lures a victim (e.g., via phishing) into clicking it. The device's websRedirect function honors the parameter and redirects the victim's browser to the attacker's domain, lending it the trust of the router's address for credential theft or malware delivery. A public exploit write-up already exists (tzh00203 notion page), lowering the effort to reproduce.