CVE-2024-48418
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In the Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC version 1.06, the /goform/fromSetDDNS request does not properly handle special characters in user-supplied parameters, allowing an attacker with web interface access to inject and execute arbitrary shell commands.
Risk Assessment
An attacker can gain full control over the router, alter its configuration, intercept network traffic, or use it as a pivot point for further attacks within the internal network.
Recommendation
Immediately update the router firmware to the latest available version, or if no patch is provided by the vendor, consider replacing the device with a model that receives current support.
Other vulnerabilities in Edimax BR-6476AC
Original NVD description (English source)
In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands.