Br 6478ac V3 Firmware
Monthly
Command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows authenticated remote attackers to execute arbitrary OS commands via the sysCmd parameter of the /boafrm/formSysCmd endpoint. Exploitation requires administrative access to the router's web interface, which significantly limits practical risk. Publicly available exploit code exists, but no active exploitation in the wild is confirmed.
OS command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows remote authenticated attackers to execute arbitrary commands via the host parameter in /boafrm/formTracerouteDiagnosticRun. A public exploit is available, and no vendor patch has been released. EPSS score is low (0.36%) and the vulnerability is not listed in CISA KEV.
Command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows authenticated attackers to execute arbitrary OS commands via the host parameter of the /boafrm/formDebugDiagnosticRun diagnostic endpoint. This vulnerability (CWE-77) requires administrative privileges (PR:H) and has a low CVSS 4.0 base score of 2.0. A public proof-of-concept exploit is available, but no active exploitation in the wild has been reported (not in CISA KEV).
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.4%.
Command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows authenticated remote attackers to execute arbitrary OS commands via the sysCmd parameter of the /boafrm/formSysCmd endpoint. Exploitation requires administrative access to the router's web interface, which significantly limits practical risk. Publicly available exploit code exists, but no active exploitation in the wild is confirmed.
OS command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows remote authenticated attackers to execute arbitrary commands via the host parameter in /boafrm/formTracerouteDiagnosticRun. A public exploit is available, and no vendor patch has been released. EPSS score is low (0.36%) and the vulnerability is not listed in CISA KEV.
Command injection in Edimax BR-6478AC V3 firmware 1.0.15 allows authenticated attackers to execute arbitrary OS commands via the host parameter of the /boafrm/formDebugDiagnosticRun diagnostic endpoint. This vulnerability (CWE-77) requires administrative privileges (PR:H) and has a low CVSS 4.0 base score of 2.0. A public proof-of-concept exploit is available, but no active exploitation in the wild has been reported (not in CISA KEV).
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.4%.