CVE-2026-12807: Edimax BR-6478AC V2 Remote Command Injection Vulnerability

Technical summary

The vulnerability resides in the POST request handler for /goform/setWAN within the Edimax BR-6478AC V2 firmware version 1.23. The affected parameters—pppUserName, pptpUserName, and L2TPUserName—fail to properly sanitize user input before passing values to system functions. This allows injection of shell metacharacters and commands that execute with the privileges of the router process. The flaw is classified as command injection (CWE-74) with improper neutralization of special elements (CWE-77). Exploitation requires valid router credentials but does not require user interaction or privilege escalation beyond initial authentication.

Business impact

Compromise of an Edimax BR-6478AC V2 router can result in unauthorized access to internal network traffic, potential Man-in-the-Middle positioning, modification of WAN settings to redirect traffic, and lateral movement into connected network segments. For small businesses or branch offices relying on this device as a primary gateway, exploitation could lead to data exfiltration, service disruption, and loss of confidentiality and integrity across all downstream network users. The public availability of exploit code increases the likelihood of opportunistic attacks.

Affected systems

The vulnerability specifically affects Edimax BR-6478AC V2 running firmware version 1.23. Organizations should inventory all instances of this router model and verify firmware versions. Check with Edimax to determine whether other BR-6478AC firmware versions or related product lines are impacted. Given the vendor's non-responsive stance on disclosure, additional undocumented vulnerabilities in this product line should be treated as a realistic concern.

Exploitability

The vulnerability is exploitable remotely over the network, but requires valid administrative credentials to access the WAN configuration interface. Public exploits are available, which significantly lowers the barrier to exploitation and increases the probability of attack attempts. Threat actors with compromised router credentials—obtained through phishing, credential stuffing, or prior network compromise—can exploit this without requiring user interaction or system-level access escalation.

Remediation

Verify current firmware versions across all Edimax BR-6478AC V2 deployments. Contact Edimax directly to request patched firmware or end-of-life guidance for this device. In the interim, restrict administrative access to the router's web interface via network segmentation, change default credentials immediately, and enable any available logging and monitoring. If patched firmware is unavailable and risk cannot be mitigated operationally, consider replacing the device with an alternative vendor solution or air-gapping the router from untrusted networks.

Patch guidance

As of the vulnerability publication date, the vendor has not responded to disclosure attempts and no official patch information is publicly available. Contact Edimax technical support with your device serial number and current firmware version to inquire about available updates. Verify any firmware release notes from the vendor advisory against this CVE identifier before deployment. Given the vendor's non-responsive history, monitor your device for unusual administrative activity and consider proactive replacement as part of a hardware refresh cycle.

Detection guidance

Monitor authentication logs on the router for failed login attempts and successful sessions from unexpected source IPs. Review WAN configuration change logs for unauthorized modifications to PPP, PPTP, or L2TP settings. Network-level monitoring should flag POST requests to /goform/setWAN containing shell metacharacters (pipes, semicolons, backticks, command substitution syntax) in query parameters. Correlate router administration events with network anomalies such as unexpected traffic redirections or data exfiltration patterns.

Why prioritize this

Although the CVSS score is moderate (6.3), the combination of public exploit availability, lack of vendor response, remote exploitability, and potential for lateral network movement warrants near-term remediation. Organizations should prioritize inventory and mitigation of this device to prevent opportunistic attacks and reduce the window of exposure before patch alternatives become available.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects the requirement for authentication (PR:L), no user interaction needed (UI:N), and impact to confidentiality, integrity, and availability (C:L, I:L, A:L) within the affected system. The score does not capture the elevated real-world risk posed by public exploits and vendor non-responsiveness. Risk assessments should elevate this to HIGH priority if the router is deployed in sensitive network roles or internet-facing administrative contexts.

Frequently asked questions