CVE-2026-12809
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk63th percentile — higher than 63% of all known CVEs
Summary
A vulnerability was identified in Edimax BR-6478AC V2 1.23, affecting the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect. Manipulation of the argument newpass leads to command injection.
Risk Assessment
An attacker can remotely exploit this vulnerability, posing a serious threat to the security of the device and the network.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and to monitor network traffic for potential attacks.
Original NVD description (English source)
A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz_5in1_redirect of the file /goform/wiz_5in1_redirect of the component POST Request Handler. Such manipulation of the argument newpass leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.