CVE-2026-82703
MediumCVSS 6.6Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
An OS command injection vulnerability was found in Edimax BR-6214K 1.40 in the system function of www/ping.asp (asp_setPing Endpoint). Manipulating the pingstr argument allows remote command execution. The exploit is public and the vendor did not respond.
Risk Assessment
A remote attack could allow full control of the router, potentially compromising the security of the entire network.
Recommendation
Disable remote access to the admin panel immediately, restrict access to trusted networks, and contact the vendor for a fix.
Other vulnerabilities in Edimax BR-6214K
Original NVD description (English source)
A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS