Edimax BR-6214K EUVD-2026-68595

Exploitation requires an authenticated HTTP session with administrative privileges to the BR-6214K web management interface, confirmed by PR:H in the CVSS 4.0 vector. The vulnerable endpoint is www/wlanMP.asp (the asp_WlanMP handler), and the specific injectable parameter is ateFunc. The attack is network-reachable (AV:N) with no user interaction beyond the attacker's own HTTP request and no special attack requirements (AT:N). Exploitation is LIMITED by the administrative authentication prerequisite - an attacker must first acquire valid admin credentials. No non-default configuration is required; the management interface is network-accessible by default on the LAN side, and may be WAN-exposed on misconfigured deployments. Limiting factors: authentication required, no confirmed WAN exposure data, and device-level scope (no evidence of lateral movement to downstream network segments).

The CVSS 4.0 score of 5.1 (Medium) is substantially moderated by the PR:H requirement - administrative credentials must be obtained before exploitation. On SOHO routers like the BR-6214K, however, default or weak admin credentials are common, meaning the practical barrier is frequently lower than PR:H implies in a lab setting. The E:P modifier in the provided vector confirms PoC availability, increasing near-term opportunistic risk. No CISA KEV listing means confirmed widespread active exploitation has not been reported to US government sources, but the absence of a vendor patch and the presence of a public exploit is a combination that demands prompt compensating action. The impact metrics in the provided vector (VC:L/VI:L/VA:L) appear conservative for a system() command injection on a device that almost certainly runs its web daemon as root - defenders should treat the realistic confidentiality and integrity impact as materially higher than the official score reflects, and not rely on the Medium score alone to deprioritize remediation for internet-exposed devices.

An attacker who has obtained administrative credentials - via credential stuffing against a device still using factory-default passwords, or by compromising the admin account through a separate vector - sends a crafted HTTP POST request to the wlanMP.asp endpoint with a malicious ateFunc value (e.g., a semicolon-delimited shell payload or reverse shell command). The system() function executes the injected command at the router's runtime privilege level, yielding OS-level code execution on the device. A public proof-of-concept is referenced in the GitHub repository linked in the disclosure, substantially reducing the required attacker skill.