CVE-2026-12808: Command Injection in Edimax BR-6478AC V2 Firmware 1.23

Technical summary

The vulnerability exists in the stainfo POST request handler of the Edimax BR-6478AC V2 router. The application fails to properly sanitize the 'interface' argument before passing it to system command execution functions. This classic command injection flaw (CWE-74: Improper Neutralization of Special Elements in Output; CWE-77: Improper Neutralization of Special Elements used in a Command) allows an authenticated user to break out of the intended command context and execute arbitrary shell commands with the privileges of the web service process. The attack surface is network-accessible and requires only standard HTTP POST capabilities.

Business impact

Compromise of an Edimax BR-6478AC V2 router enables an attacker to gain command-level control over network infrastructure. Potential consequences include unauthorized access to internal network traffic, lateral movement to connected systems, exfiltration of sensitive data, deployment of malware or persistent backdoors, and denial of service. For organizations using these devices as primary or secondary network gateways—particularly in remote offices or branch locations—successful exploitation could compromise entire network segments.

Affected systems

This vulnerability specifically affects Edimax BR-6478AC V2 running firmware version 1.23. Organizations should inventory any instances of this router model and firmware version across their infrastructure. Other firmware versions of the same model and different Edimax router models may have similar or related issues, but this CVE addresses only the v1.23 variant.

Exploitability

Exploitation requires valid authentication credentials and network access to the router's web interface (typically port 80 or 443). While this is not a zero-day or unauthenticated vulnerability, the barrier to exploitation is modest—weak default credentials, credential reuse, or insider threats substantially lower practical difficulty. The exploit has been publicly disclosed, meaning threat actors possess working proof-of-concept code and detailed technical information. Active exploitation should be anticipated.

Remediation

Check the Edimax support website for a firmware update beyond version 1.23 that addresses this command injection flaw. If no patched version is available or the device is end-of-life, consider replacing it with a router from a vendor with active security support. In the interim, implement network segmentation to restrict administrative access to the router's web interface to trusted IP ranges only, and enforce strong, unique passwords on all administrative accounts.

Patch guidance

Verify that Edimax has released a patched firmware version for the BR-6478AC V2. Download any available update directly from the Edimax website and follow their documented upgrade procedure. If no patch is publicly available, contact Edimax support with CVE-2026-12808 as a reference. Note that the vendor was contacted early but did not respond, which may indicate limited or delayed patching availability. In such cases, prioritize network access controls and monitoring as compensating controls.

Detection guidance

Monitor for POST requests to /goform/stainfo with unusual or suspicious values in the 'interface' parameter, particularly those containing shell metacharacters (semicolons, pipes, backticks, command substitution syntax). Log and alert on successful authentication followed by requests to this endpoint. Review router access logs for administrative logins from unexpected IP addresses. Consider implementing a Web Application Firewall (WAF) rule to block requests with command injection payloads to this endpoint, if your infrastructure supports it.

Why prioritize this

Although this vulnerability requires authentication, its network-accessible nature, public disclosure, and command injection severity justify medium-priority remediation. The CVSS 3.1 score of 6.3 reflects the combination of low barrier to exploitation (once authenticated) and moderate impact. Organizations should address this within 30 days, particularly if the affected router has internet-facing administrative interfaces or is deployed in environments with elevated insider risk.

Risk score, explained

The CVSS 3.1 score of 6.3 (Medium) reflects: attack vector network-accessible, attack complexity low (straightforward exploitation), privilege level low (requires authentication), no user interaction needed, scope unchanged to the vulnerable component, and confidentiality/integrity/availability impacts all rated as low. The score appropriately captures that while command injection is fundamentally dangerous, the requirement for prior authentication prevents a critical rating. In practice, risk may be higher or lower depending on the robustness of authentication controls and the router's network exposure.

Frequently asked questions