CVE-2026-12809: Edimax BR-6478AC V2 Command Injection Vulnerability

Technical summary

CVE-2026-12809 is a command injection flaw (CWE-74, CWE-77) in the POST request handler for /goform/wiz_5in1_redirect on affected Edimax routers. The wiz_5in1_redirect function fails to properly sanitize the newpass parameter before passing it to a system command execution context. This allows an authenticated user to inject shell metacharacters and execute arbitrary system commands with the privileges of the router's web service. The vulnerability is network-accessible and does not require user interaction beyond authentication.

Business impact

An attacker with valid credentials can execute arbitrary commands on the router, potentially enabling lateral movement into the network, data exfiltration, denial of service, or persistent compromise. For organizations deploying Edimax BR-6478AC V2 as an edge device or branch gateway, this creates a backdoor that could bypass perimeter controls. The availability of public exploit code elevates the risk of opportunistic exploitation, particularly against devices with default or weak credentials.

Affected systems

Edimax BR-6478AC V2 running firmware version 1.23 is confirmed vulnerable. Organizations should verify whether this model is deployed in production environments, including remote offices, guest networks, or IoT management segments. The BR-6478AC series is commonly used as a wireless router in small business and branch deployments. Check inventory and patch management systems for this exact model and firmware version.

Exploitability

Exploitation requires valid authentication credentials but no elevated privilege or special user interaction. Network accessibility combined with the availability of public exploit code creates moderate to high exploitability. Devices exposed to untrusted networks or with default credentials (common in edge deployments) face elevated risk. The CVSS 3.1 score of 6.3 (MEDIUM) reflects the authentication requirement; however, the presence of public exploits and real-world prevalence of weak credentials should influence risk prioritization upward in most environments.

Remediation

Contact Edimax support to verify availability of patched firmware for the BR-6478AC V2 beyond version 1.23. The vendor did not respond to early disclosure attempts, so patch availability is uncertain. Interim mitigations include: restricting access to the /goform/wiz_5in1_redirect endpoint via network segmentation, disabling remote management if possible, enforcing strong unique credentials, and monitoring command execution logs for suspicious activity. Consider replacement with a supported device if patches remain unavailable after a reasonable inquiry period.

Patch guidance

Verify directly with Edimax whether a patched firmware version exists for BR-6478AC V2 above 1.23. If a patch becomes available, test it in a non-production environment before deployment. If no patch is forthcoming, evaluate alternative routers from vendors with active security support. Maintain an audit log of when each device was last checked for updates. For critical deployments, consider segmenting this device behind additional access controls or replacing it entirely.

Detection guidance

Monitor for POST requests to /goform/wiz_5in1_redirect with suspicious characters in the newpass parameter (shell metacharacters such as ;, |, &, $(), backticks, or newlines). Enable access logging on the device if available. Look for unexpected system command execution logs (e.g., sh, bash, or system calls) initiated from the web service process. Network intrusion detection systems can flag payloads containing command injection signatures targeting this endpoint. Alert on multiple failed authentication attempts followed by successful requests to this function.

Why prioritize this

Although the CVSS score is 6.3 (MEDIUM), several factors warrant elevated priority: public exploit availability, authentication bypass risk via default credentials common in edge devices, network accessibility, and vendor non-responsiveness. Command injection on a router can compromise an entire network segment. Prioritize inventory assessment and isolation of affected devices within 30 days.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a network-accessible flaw with low attack complexity but requiring authentication (AV:N, AC:L, PR:L). The impact is partial across confidentiality, integrity, and availability (C:L, I:L, A:L). This classification is conservative because it assumes properly configured credentials. In reality, many deployed Edimax routers use default or weak passwords, effectively lowering the barrier to exploitation. Additionally, the public availability of exploit code significantly increases practical risk beyond the numerical score. Organizations should treat this as a high-priority issue despite the MEDIUM label.

Frequently asked questions