CVE-2026-10166
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Edimax BR-6478AC router version 1.23 has a command injection vulnerability in the formWlbasic function. Manipulating the rootAPmac argument allows remote command execution. The exploit is public.
Risk Assessment
An attacker can remotely take control of the router, alter its configuration, or use it for further network attacks.
Recommendation
Check for a firmware update from the vendor and apply it immediately.
Other vulnerabilities in Edimax BR-6478AC
See all- CVE-2026-10165High
A stack-based buffer overflow was identified in Edimax BR-6478AC version 1.23 in the formWanTcpipSetup function of the /goform/formWanTcpipSetup file. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10164High
A vulnerability was found in Edimax BR-6478AC 1.23. The function formUSBFolder of the file /goform/formUSBFolder is affected by buffer overflow via manipulation of the ShareName/SelectName arguments, allowing remote exploitation.
- CVE-2026-10163High
A vulnerability has been found in Edimax BR-6478AC 1.23. The function formUSBAccount of the file /goform/formUSBAccount is affected by buffer overflow via manipulation of the UserName/Password arguments, allowing remote exploitation.
- CVE-2026-10127Medium
In Edimax BR-6478AC 1.23, the formStaDrvSetup function in /goform/formStaDrvSetup is vulnerable to command injection via the rootAPmac argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10126High
Buffer overflow in the formQoS function of Edimax BR-6478AC 1.23 allows a remote attacker to execute code by manipulating the selSSID argument.
- CVE-2026-10125High
In Edimax BR-6478AC version 1.23, a stack-based buffer overflow vulnerability was found in the formPPPoESetup function of the /goform/formPPPoESetup file. The attack involves manipulating the pppUserName argument and can be performed remotely. The exploit is publicly available.
- CVE-2026-9443High
Buffer overflow vulnerability in the formL2TPSetup function in /goform/formL2TPSetup on Edimax BR-6478AC 1.23. Manipulating the L2TPUserName argument can lead to buffer overflow.
- CVE-2026-9442High
Buffer overflow vulnerability in the formiNICSiteSurvey function in /goform/formiNICSiteSurvey on Edimax BR-6478AC 1.23. Manipulating the selSSID argument can lead to buffer overflow.
- CVE-2026-9441Medium
A vulnerability in Edimax BR-6478AC 1.23. The formiNICbasic function in /goform/formiNICbasic of the POST Request Handler component allows command injection via the rootAPmac argument. Remote attack, exploit public.
- CVE-2026-9440Medium
A vulnerability in Edimax BR-6478AC 1.23. The formAccept function in /goform/formAccept of the POST Request Handler component allows command injection via the submit-url argument. Remote attack possible, exploit public.
Original NVD description (English source)
A vulnerability was determined in Edimax BR-6478AC 1.23. The affected element is the function formWlbasic of the file /goform/formWlbasic of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.