EUVD-2026-29203
GHSA-c9c6-xfr6-q42w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker is able to execute arbitrary system commands on the device.
AnalysisAI
Command injection in EDIMAX BR-6428nS V3 wireless router firmware 1.15 allows authenticated attackers to execute arbitrary system commands via crafted input to WLAN configuration interface. The vulnerability requires low-privilege network authentication but no user interaction, enabling complete device compromise including credential theft, traffic interception, and pivot attacks into connected networks. EPSS score of 0.17% suggests low probability of mass exploitation, though a proof-of-concept is publicly available on GitHub, lowering the barrier for targeted attacks against exposed management interfaces.
Technical ContextAI
This vulnerability affects the WLAN configuration module in EDIMAX BR-6428nS V3 router firmware version 1.15. The root cause is CWE-77 (Command Injection), where the device fails to properly sanitize user-supplied input before passing it to system shell commands. When processing WLAN configuration parameters, the firmware likely concatenates user input directly into shell commands without validation, allowing shell metacharacters to break out of intended command structure. This is a common vulnerability class in embedded network devices where web interfaces invoke system utilities through shell wrappers. The CPE data from NVD is incomplete (showing 'n/a'), but the CVE description and vendor reference clearly identify the specific product model and firmware version affected.
RemediationAI
EDIMAX has not released public vendor security advisories or confirmed patched firmware versions at the time of analysis based on available references. Users should immediately check the EDIMAX support website (http://edimax.com) for firmware updates newer than version 1.15 and apply them if available. As interim compensating controls with specific trade-offs: (1) Disable remote administration features and restrict management interface access to trusted local networks only via firewall rules - this prevents internet-based exploitation but requires physical or VPN access for legitimate administration; (2) Change default administrative credentials to strong unique passwords - reduces but does not eliminate risk if attackers have network access; (3) Implement network segmentation to isolate the router's management VLAN from production networks - contains post-exploitation lateral movement but adds configuration complexity; (4) Monitor router logs for unusual WLAN configuration changes or command execution patterns - provides detection not prevention and requires log forwarding infrastructure. Organizations with critical security requirements should consider replacing affected devices with alternative routers that receive active security support, as this is an end-of-life consumer product with uncertain vendor support commitment.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today