CVE-2026-10127 in BR-6478AC
Summary
by MITRE • 05/30/2026
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/12/2026
The vulnerability in Edimax BR-6478AC version 1.23 represents a critical command injection flaw within the device's web interface management system. This weakness exists in the formStaDrvSetup function located in the /goform/formStaDrvSetup file, which serves as part of the POST Request Handler component. The specific vulnerability manifests when the rootAPmac argument parameter is manipulated, allowing attackers to inject arbitrary commands that execute with the privileges of the web server process. This type of vulnerability falls under CWE-77 which specifically addresses command injection flaws in software applications. The attack vector is remote, meaning that an attacker does not require physical access to the device to exploit this weakness, significantly expanding the potential attack surface.
The operational impact of this vulnerability is severe as it allows remote code execution on the affected device, potentially enabling attackers to gain full administrative control over the router. Once exploited, the attacker could modify network configurations, intercept traffic, establish backdoors, or use the device as a pivot point for further attacks within the local network. The fact that a public exploit has been made available increases the likelihood of successful attacks, as it removes the requirement for advanced exploitation techniques and reduces the time needed to compromise the device. This vulnerability directly aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter, specifically targeting web shell execution and remote command execution capabilities. The exposure of the vulnerability through the web form interface means that any user with access to the device's management portal could potentially exploit this flaw.
Mitigation strategies for this vulnerability should focus on immediate remediation through firmware updates from Edimax, as the manufacturer would need to implement proper input validation and sanitization for the rootAPmac parameter. Network segmentation and access controls should be implemented to limit exposure of the device to untrusted networks, while monitoring for suspicious web requests and unusual network behavior can help detect exploitation attempts. The device should be configured to disable unnecessary web management interfaces and restrict access to authorized personnel only. Additionally, network administrators should consider implementing intrusion detection systems that can identify command injection patterns in HTTP requests. Regular security audits of network devices and maintaining up-to-date security patches are essential practices to prevent exploitation of similar vulnerabilities. Organizations should also consider deploying network access control measures that can block unauthorized access attempts to management interfaces and implement secure configuration baselines for all network equipment to reduce the attack surface and prevent similar command injection vulnerabilities from being exploited in other components of the network infrastructure.