CVE-2026-12810: Edimax BR-6478AC V2 Command Injection Vulnerability Analysis

Technical summary

The vulnerability exists in the POST Request Handler component at /goform/mp in Edimax BR-6478AC V2 firmware 1.23. The mp function fails to properly sanitize the 'command' parameter, allowing OS command injection through metacharacters. An attacker with valid authentication credentials can craft a malicious POST request containing shell metacharacters or command chaining syntax to break out of the intended command context and execute arbitrary commands with the privileges of the web server process.

Business impact

Compromised routers can become a foothold for lateral network movement, credential harvesting, or deployment of persistent backdoors. Because routers typically have trusted network position and continuous uptime, they are attractive targets for establishing covert command-and-control infrastructure or monitoring internal traffic. For organizations relying on these devices, a breach may facilitate data exfiltration, malware distribution to connected clients, or targeted attacks on critical internal systems.

Affected systems

Edimax BR-6478AC V2 devices running firmware version 1.23 are confirmed vulnerable. Organizations should verify whether they operate this specific router model and firmware revision in production environments, particularly in branch offices, retail locations, or other network edge scenarios where these consumer-grade devices are commonly deployed.

Exploitability

Exploitability is moderately high due to three factors: the requirement for valid authentication credentials raises the bar compared to unauthenticated exploits, but the attack complexity is low and the exploit is already public. Organizations should assume malicious actors with internal network access or compromised user accounts can leverage this vulnerability with minimal additional effort.

Remediation

Contact Edimax support to determine if a patched firmware version is available for the BR-6478AC V2. Verify against the vendor advisory for specific version numbers and upgrade paths. If no patch is forthcoming, consider replacing affected devices with models from vendors actively supporting security updates, or isolate vulnerable routers to restricted administrative networks with strict access controls.

Patch guidance

Check Edimax's official support portal for firmware updates targeting the BR-6478AC V2. The vendor did not respond to early disclosure attempts, so patch availability is uncertain. Document the firmware version running on all instances of this device model in your environment so you can prioritize deployment of any released update. If no official patch emerges within a reasonable timeframe, prepare contingency plans for device replacement or decommissioning.

Detection guidance

Monitor web server logs on affected routers for POST requests to /goform/mp containing suspicious characters (backticks, $(), semicolons, pipes, &&, ||) in the command parameter. Network intrusion detection systems should flag requests with shell metacharacters in that endpoint. Log and alert on any successful command execution originating from the web management service. Conduct periodic inventory audits to identify which devices on your network are BR-6478AC V2 units and their current firmware versions.

Why prioritize this

Although marked CVSS 6.3 Medium, this vulnerability warrants prompt attention because: (1) exploit code is public and weaponized, (2) the device occupies a trusted network boundary position, (3) the vendor is unresponsive, making patching uncertain, and (4) successful exploitation enables full device compromise and lateral movement. Organizations using this router model should treat it as a higher-priority remediation item than the base CVSS score alone suggests.

Risk score, explained

The CVSS 6.3 Medium score reflects an authenticated attack vector (AV:N/AC:L/PR:L) with limited scope and impact (confidentiality, integrity, and availability each degraded). However, the public exploit and vendor non-responsiveness increase operational risk. The score appropriately captures technical severity but does not account for the router's network-critical role or supply-chain implications of an unpatched device.

Frequently asked questions