14
CVEs
0
Critical
5
High
0
KEV
14
PoC
5
Unpatched C/H
0.0%
Patch Rate
1.0%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
0
LOW
9
Monthly CVE Trend
Affected Products (28)
Ew 7438Rpn
24
Br 6675Nd
12
Br 6478Ac
10
Re11S Firmware
8
Br 6478ac V3 Firmware
8
Ew 7478Apc
7
Ew 7438rpn Mini Firmware
7
Br 6428Ns
7
Br 6208ac Firmware
6
Br 6476Ac Firmware
5
Br 6478Ac V2
5
Br 6208Ac V1 Firmware
3
Br 6288Acl Firmware
3
Br 6428Ns Firmware
3
Ic 3140W Firmware
3
Br 6214K
2
Ic 5150W Firmware
2
Br 6208Ac
2
Br 6428Nc
2
Open Redirect
2
Ic 6220Dc Firmware
2
Br 6473Ax Firmware
1
Ic 7100 Firmware
1
Cv 7428Ns Firmware
1
Edimax Ew 7438Rpn V2 Firmware
1
Br 6228Nc
1
Ic 3116W Firmware
1
Br 6258N Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19959 | Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-12806 | Stack/heap buffer overflow in the Edimax BR-6478AC V2 wireless router (firmware 1.23) lets an authenticated attacker corrupt memory by sending an oversized selSSID parameter to the formWlSiteSurvey handler under /goform/, enabling denial of service and potentially arbitrary code execution on the device. Publicly available exploit code exists, but no public exploit identified at time of analysis as actively used in attacks (not in CISA KEV); the vendor was notified and did not respond, leaving devices unpatched. CVSS 4.0 base score is 7.4 reflecting network reachability of the management interface combined with required low-privilege authentication. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-13583 | Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory by sending an oversized ShareName or SelectName argument to the formUSBFolder handler at /goform/formUSBFolder. The flaw is reachable over the network and publicly available exploit code exists, though no active exploitation has been reported. Per the CVSS 4.0 vector it requires low-level authentication (PR:L) but yields full confidentiality, integrity, and availability impact on the device. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-13580 | Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers overflow a buffer by manipulating the selSSID parameter in a POST request to the /goform/formQoS endpoint, potentially crashing the device or executing code on it. The flaw is network-reachable and publicly available exploit code exists (disclosed via VulDB and a Notion writeup), but it is not listed in CISA KEV and no active exploitation has been confirmed. The vendor was notified but did not respond, and no patched firmware has been published. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-13582 | Remote buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets an authenticated attacker corrupt memory through the formUSBAccount handler at /goform/formUSBAccount by supplying oversized UserName or Password values in a POST request, enabling likely code execution or device crash. The flaw is remotely reachable and publicly available exploit code exists (proof-of-concept, CVSS 4.0 base 7.4), though there is no public exploit identified as actively used in the wild. The vendor was notified but did not respond, so no fix is expected. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-13581 | OS command injection in the Edimax EW-7478APC wireless access point firmware 1.04 allows a network-reachable authenticated attacker to execute arbitrary OS commands on the device by manipulating the `rootAPmac` parameter in POST requests to `/goform/formStaDrvSetup`. A public proof-of-concept exploit is available, indexed by VulDB and documented externally, and the vendor did not respond to responsible disclosure - making a vendor-released patch unlikely in the near term. The provided CVSS 4.0 score of 2.1 appears to significantly understate actual impact, as OS command injection on embedded Linux network devices typically yields full device compromise rather than the 'Low' impact across all three dimensions assigned in the vector. | LOW | 2.1 | 1.2% | 32 |
PoC
No patch
|
| CVE-2026-19960 | Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `rootAPmac` parameter submitted to the `/goform/formWlbasic` CGI endpoint. A public proof-of-concept exploit has been disclosed via VulDB and a linked Notion page. The vendor did not respond to coordinated disclosure, leaving no patch available and the exposure window indefinite. | LOW | 2.1 | 1.2% | 32 |
PoC
No patch
|
| CVE-2026-19962 | Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbitrary OS commands by supplying shell metacharacters in WAN credential fields (pppUserName, pptpUserName, or L2TPUserName) through the /goform/setWAN endpoint. A publicly available proof-of-concept exploit has been published, raising real-world exploitation risk despite the moderate CVSS score. No vendor patch exists - the vendor did not respond to the coordinated disclosure, leaving affected users without an official remediation path. | LOW | 2.1 | 1.2% | 32 |
PoC
No patch
|
| CVE-2026-12807 | Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privileged web interface access to execute arbitrary OS commands by injecting shell metacharacters into WAN credential parameters submitted via POST to /goform/setWAN. A public proof-of-concept exploit is documented and available, the vendor did not respond to coordinated disclosure, and no patch exists - leaving only compensating controls as mitigation. No public exploit identified at time of analysis in CISA KEV, but the combination of public PoC, zero vendor response, and SOHO device deployment patterns represents materially elevated real-world risk. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|
| CVE-2026-12808 | Command injection in the Edimax BR-6478AC V2 router (firmware 1.23) allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `interface` argument in POST requests to `/goform/stainfo`. No patch is available - Edimax did not respond to coordinated disclosure - and a public proof-of-concept exploit exists, making this a persistent, unmitigated risk on deployed devices. The vendor-reported CVSS 4.0 score of 2.1 appears to significantly understate actual impact, as unrestricted command injection on embedded router firmware typically enables full system control rather than merely low-severity limited access. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|
| CVE-2026-12809 | Command injection in Edimax BR-6478AC V2 firmware 1.23 allows remote attackers with low-privilege credentials to execute arbitrary OS commands by embedding shell metacharacters in the `newpass` argument of POST requests to the `/goform/wiz_5in1_redirect` endpoint. A public proof-of-concept exploit exists and is referenced in the VulDB disclosure, making this straightforwardly reproducible. The vendor has not responded to coordinated disclosure, leaving no official patch available - a significant concern for a SOHO network gateway that sits at the perimeter of home and small-office networks. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|
| CVE-2026-12810 | Command injection in the Edimax BR-6478AC V2 router (firmware 1.23) allows network-adjacent authenticated attackers to execute arbitrary OS commands via the `command` argument in POST requests to the `/goform/mp` endpoint. The vulnerability is rooted in insufficient input sanitization in the `mp` form handler, exposing the router's underlying OS to attacker-controlled commands. A public proof-of-concept exploit has been released and the vendor has not responded to disclosure, leaving no patch available - the device remains unmitigated at time of analysis. | LOW | 2.1 | 1.2% | 30 |
PoC
No patch
|
| CVE-2026-82702 | OS command injection in Edimax BR-6214K firmware version 1.40 allows a remote authenticated administrator to execute arbitrary operating system commands by supplying a crafted value to the ateFunc parameter of the wlanMP.asp endpoint, which passes it unsanitized to a system() call. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for post-authentication exploitation. No vendor patch exists and the vendor did not respond to disclosure; no CISA KEV listing means active exploitation has not been confirmed by US government sources, though the unpatched status combined with public PoC availability elevates near-term risk. | LOW | 2.0 | 2.1% | 30 |
PoC
No patch
|
| CVE-2026-82703 | OS command injection in Edimax BR-6214K firmware 1.40 allows an authenticated administrator to execute arbitrary commands on the router's underlying embedded OS by supplying shell metacharacters in the `pingstr` argument of the `asp_setPing` web endpoint. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to disclosure nor issued a patch. Despite the low CVSS 4.0 score of 2.0 - driven entirely by the PR:H authentication requirement - successful exploitation yields root-level command execution on the device, making the practical impact significantly higher than the score suggests for any attacker who already possesses admin credentials. | LOW | 2.0 | 2.1% | 30 |
PoC
No patch
|