EUVD-2026-38196
GHSA-9g76-6r22-3642
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network POST endpoint, low-privilege auth required (PR:L); command injection on embedded router OS yields full system compromise, so C/I/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in the Edimax BR-6478AC V2 router (firmware 1.23) allows network-adjacent authenticated attackers to execute arbitrary OS commands via the command argument in POST requests to the /goform/mp endpoint. The vulnerability is rooted in insufficient input sanitization in the mp form handler, exposing the router's underlying OS to attacker-controlled commands. A public proof-of-concept exploit has been released and the vendor has not responded to disclosure, leaving no patch available - the device remains unmitigated at time of analysis.
Technical ContextAI
The affected component is the mp function within the Edimax BR-6478AC V2 web management interface, reachable via POST requests to /goform/mp. This is a common embedded Linux web server endpoint pattern (goform) used in SOHO routers where form parameters are often passed directly or with insufficient sanitization to shell commands or system() calls - the root cause class is CWE-77 (Improper Neutralization of Special Elements used in a Command). The CPE string cpe:2.3:a:edimax:br-6478ac_v2:*:*:*:*:*:*:*:* confirms the affected product and version line. The CVSS 4.0 threat metric E:P confirms the exploit is at proof-of-concept stage. The provided CVSS 4.0 impact metrics VC:L/VI:L/VA:L appear inconsistent with typical OS command injection severity; defenders should independently verify whether the injection is limited to a restricted command set or yields full shell access.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor did not respond to the researcher's disclosure. As a primary compensating control, restrict access to the router's web management interface (TCP port 80/443 or configured management port) to trusted management hosts only, using firewall ACLs or the router's own access control settings if available; this prevents unauthenticated or low-privilege access from untrusted network segments. Disable remote management if enabled. If the router supports firmware update checks independently, monitor for any future firmware releases from Edimax for BR-6478AC V2. Consider replacing this device with a supported model if no patch materializes, especially in security-sensitive deployments. The public PoC is documented at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-mp-34b53a41781f80339677f24176f4f6b7 - review it to understand specific trigger conditions and refine network-level blocking.
More in Br 6478Ac V2
View allStack/heap buffer overflow in the Edimax BR-6478AC V2 wireless router (firmware 1.23) lets an authenticated attacker cor
Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privilege credentials to execute
Command injection in the Edimax BR-6478AC V2 router (firmware 1.23) allows authenticated remote attackers to execute arb
Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privileged web interface access
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today