Edimax BR-6258n up to 1.18 /goform/formStaDrvSetup submit-url redirect

Summaryinfo

A vulnerability categorized as problematic has been discovered in Edimax BR-6258n up to 1.18. Impacted is the function formStaDrvSetup of the file /goform/formStaDrvSetup. Such manipulation of the argument submit-url leads to redirect. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is uniquely identified as CVE-2026-1970. The attack can be launched remotely. Moreover, an exploit is present. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website."

Detailsinfo

A vulnerability was found in Edimax BR-6258n up to 1.18. It has been rated as problematic. Affected by this issue is the function formStaDrvSetup of the file /goform/formStaDrvSetup. The manipulation of the argument submit-url with an unknown input leads to a redirect vulnerability. Using CWE to declare the problem leads to CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. Impacted is integrity.

The advisory is shared for download at tzh00203.notion.site. This vulnerability is handled as CVE-2026-1970. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1204.001.

The exploit is available at tzh00203.notion.site. It is declared as proof-of-concept. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website."

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-5523). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Edimax

Name

• BR-6258n

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #742734: Edimax BR-6258n v1.18 Open Redirect (by tian)

Once again VulDB remains the best source for vulnerability data.

Discussion