Edimax BR-6675nD EUVD-2026-31627

Exploitation requires the attacker to hold valid high-privileged (administrative-level) credentials for the Edimax BR-6675nD web management interface - confirmed by CVSS PR:H. The /goform/mp endpoint must be reachable over the network (AV:N); exploitation from the internet is only possible if the management interface is exposed on the WAN side, which is a non-default but common misconfiguration on SOHO devices. No special non-default firmware feature or configuration mode is described as required beyond authenticated access to the management UI. The SSVC Automatable: no assessment directly reflects the credential prerequisite as the primary friction against automated mass exploitation. Limiting factors for defenders: requiring strong unique credentials, disabling WAN management access, and network-level ACLs each independently reduce exploitability, with WAN isolation being the most impactful single control.

Multiple signals converge on a low-to-moderate real-world risk rating. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N scores only 2.0 because the PR:H (high privileges required) component is the dominant depressor - an attacker must already hold administrative credentials, substantially narrowing the attack surface. EPSS at 0.23% (46th percentile) corroborates limited automated exploitation interest. SSVC confirms Automatable: no and Technical Impact: partial, consistent with the authentication barrier and limited scope (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N). The E:P exploitability modifier in the CVSS vector and the confirmed public POC are the key escalation signals - the exploitation bar is lower for anyone who has already gained credentials. No CISA KEV listing is present in the provided data, meaning mass or confirmed active exploitation is not established. The most realistic concern is targeted attacks against internet-exposed management interfaces where credentials have been reused or brute-forced. Organizations with this device exposed to the WAN should treat this as higher priority despite the low base score.

An attacker who has obtained or brute-forced the administrative password for a network-accessible Edimax BR-6675nD management interface submits a crafted POST request to /goform/mp with a shell metacharacter-delimited OS command injected into the command parameter. The unpatched mp handler passes the unsanitized value directly to the system command interpreter, executing the attacker's payload with the web process's privilege level on the router. A public POC demonstrating this technique is available at the Notion-hosted exploit page referenced in the VulDB disclosure, reducing the required technical expertise for a motivated attacker who already holds credentials.