Edimax BR-6428nC EUVD-2026-26821

Exploitation requires valid router administrator authentication credentials (not default/unauthenticated access). The attacker must be able to reach the router's web interface over the network (HTTP/HTTPS on port 80/443, or custom ports if configured). The /goform/setWAN endpoint must be accessible in the router's web interface, which is enabled by default. No special router configuration is required beyond normal operation; the vulnerability is present in the default configuration of affected versions. Exploitation is limited by the authentication requirement-attackers cannot exploit this from the public internet unless they first obtain valid admin credentials through phishing, credential stuffing, default credentials, or local network access. The command execution context is not confirmed; the low CVSS impact scores (VC:L/VI:L/VA:L) suggest the executed commands may run in a restricted shell or non-root context, limiting the practical impact despite successful code execution.

Despite a low CVSS score of 2.1, this vulnerability presents moderate operational risk for affected deployments. The CVSS vector shows attack complexity is low (AC:L) and exploitability is probable (E:P), with public exploit code available, elevating practical threat above the numerical score. However, exploitation requires prior authentication (PR:L), significantly limiting attack surface-only users with valid router credentials can trigger the vulnerability. The impact is limited to low confidentiality, integrity, and availability per the vector (VC:L/VI:L/VA:L), suggesting command execution is restricted (possibly to non-root contexts or limited shell access). The critical mismatch between low CVSS and the severity of command injection suggests either: (1) execution context is unprivileged, or (2) the router's architecture limits the scope of commands. Verification with the vendor would clarify. For organizations operating this router in isolated networks or with strong admin credential controls, risk is manageable; for devices exposed to untrusted users or with weak credentials, risk is significant. The vendor's non-response and lack of patched firmware versions mean no official remediation path exists.

An authenticated attacker with router admin credentials crafts an HTTP POST request to /goform/setWAN with a malicious pppUserName parameter containing shell metacharacters and command sequences (e.g., 'user; rm -rf /', or backtick-enclosed commands). The vulnerable endpoint passes this unsanitized string to a shell command invoked during WAN configuration, executing the injected commands with the privileges of the router's web service process. A POC demonstrating this attack is publicly available on the researcher's Notion page.