Edimax BR-6214K EUVD-2026-68576

Exploitation requires valid administrative credentials for the Edimax BR-6214K web management interface (CVSS PR:H) - access to www/ping.asp is gated behind admin authentication. The attack originates over the network (CVSS AV:N), meaning the attacker must be able to reach the router's web management port (typically TCP 80 or 443). Exploitation is constrained by: (1) admin-level authentication - default credentials must be in use or credentials must otherwise be known to the attacker; (2) network reachability to the web management interface - standard LAN-only admin access with WAN remote management disabled substantially limits the attack surface to local network adversaries. No non-default configuration flag or special firmware feature needs to be enabled beyond the always-present web admin interface.

The CVSS 4.0 score of 2.0 is substantially depressed by the PR:H metric, reflecting that admin authentication is required before the vulnerable endpoint is reachable. This is the primary limiting factor and should be the defender's focus: if admin credentials are secured and WAN-side management is disabled, exploitation from the internet is blocked. However, several signals elevate practical concern: a public PoC is available (GitHub, E:P in the CVSS 4.0 supplemental vector), the vendor has not responded to disclosure and no patch exists, and the CPE wildcard version field suggests all firmware versions may be affected - not only 1.40. EPSS data is absent from the input, preventing quantitative exploitation probability assessment. KEV status is negative, suggesting no confirmed widespread exploitation at time of analysis. The low VC:L/VI:L/VA:L impact sub-metrics in the provided CVSS 4.0 vector appear to understate actual impact - OS command execution on a router yields full device control, which conflicts with 'Low' impact ratings; this discrepancy should be verified against the scoring rationale. Real-world risk is highest for devices with default or weak admin credentials and WAN-side management exposed to the internet.

An attacker who has obtained the router's admin password - via default credential reuse, credential stuffing, or LAN sniffing - authenticates to the web admin panel and submits a crafted request to the asp_setPing endpoint with a pingstr value such as 8.8.8.8; id or a reverse shell payload. The embedded OS executes the injected command as root, granting the attacker full control of the router including persistent backdoors, traffic interception, or DNS hijacking. A public PoC demonstrating this technique is available on GitHub at the reference URL.