CVE-2025-70161

Critical

Published: 09/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

EDIMAX BR-6208AC router version V2_1.02 is vulnerable to command injection. The pppUserName field is passed directly to the system() function without proper sanitization, allowing an attacker to execute arbitrary code.

Risk Assessment

An attacker can execute arbitrary commands on the router, potentially leading to device takeover, network traffic interception, or further attacks within the network.

Recommendation

Upgrade the router firmware to the latest available version. If not available, restrict access to the admin panel and change default passwords.

Original NVD description (English source)

EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.