CVE-2026-9296
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A command injection vulnerability has been found in Edimax BR-6428NS version 1.10 in the system function of the /goform/formWlanM file. The attack can be launched remotely by manipulating multiple arguments.
Risk Assessment
A remote attacker can execute arbitrary commands on the device, potentially leading to device compromise and network security breaches.
Recommendation
Update the device firmware immediately if a patch is available. If the vendor does not provide support, consider replacing the device.
Other vulnerabilities in Edimax BR-6428NS
See all- CVE-2026-8775High
A flaw has been found in Edimax BR-6428NS version 1.10 affecting the function formL2TPSetup in the file /goform/formL2TPSetup. Manipulation of the argument L2TPUserName causes buffer overflow, allowing for remote attack initiation.
- CVE-2026-9297Medium
A command injection vulnerability was identified in Edimax BR-6428NS version 1.10 in the formWlbasic function of the /goform/formWlbasic file. An attacker can remotely manipulate the repeaterSSID argument, leading to arbitrary command execution. The exploit has been publicly disclosed and may be used.
- CVE-2026-9295High
A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWirelessTbl function of /goform/formWirelessTbl. Manipulation of the vapurl argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.
- CVE-2026-9294High
A buffer overflow vulnerability was found in Edimax BR-6428NS version 1.10 in the formWanTcpipSetup function of /goform/formWanTcpipSetup. Manipulation of the pppUserName argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.
Original NVD description (English source)
A weakness has been identified in Edimax BR-6428NS 1.10. This impacts the function system of the file /goform/formWlanM of the component POST Request Handler. Executing a manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.