Edimax BR‑6478AC routers running firmware version 1.23 are vulnerable to command injection through the formStaDrvSetup endpoint. The rootAPmac argument is not properly sanitized, allowing an attacker to inject arbitrary shell commands via a crafted POST request. Execution of malicious commands can compromise the device’s operating system, leading to loss of confidentiality, integrity, and availability of the network infrastructure managed by the router.

The affected hardware is the Edimax BR‑6478AC router. Firmware version 1.23 is identified as vulnerable. It is inferred that only this specific firmware release is affected, whereas later releases might contain a fix, but this has not been confirmed by the vendor.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, so the exploitation probability remains uncertain, and the vulnerability is not listed in CISA’s KEV catalog. A public exploit exists and can be triggered remotely through a POST request to /goform/formStaDrvSetup. It is inferred that the attacker’s prerequisites are minimal, requiring only network connectivity to the router’s web interface, which represents a low‑barrier attack vector.