Edimax BR‑6478AC firmware 1.23 has a flaw in its formWlbasic POST handler that allows an attacker to manipulate the rootAPmac argument and inject arbitrary OS commands. The flaw is a classic command injection (CWE‑74) involving missing input validation (CWE‑77). The vulnerability can be exploited remotely, as the CVE description states the attack is possible to be carried out remotely. However, the description does not explicitly state whether authentication is required to access the vulnerable endpoint; this detail is therefore inferred rather than confirmed.

The vulnerability affects Edimax BR‑6478AC routers running firmware version 1.23. No other versions or product variants are listed. The build is identified by the CPE cpe:2.3:o:edimax:br-6478ac_firmware:*:*:*:*:*:*:* and the vendor’s published advisory references the same firmware level.

The CVSS score of 5.3 indicates a moderate level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack path involves sending a crafted POST request to the /goform/formWlbasic endpoint. Because the description does not specify authentication requirements, we infer that the endpoint may be accessible without authentication, but this is not definitively stated. The vulnerability has been publicly disclosed and exploiting it would allow remote command execution on the device, representing a credible threat.