The flaw is a command injection vulnerability in the POST handler for /goform/setWAN that allows an unauthenticated attacker to inject and execute arbitrary operating‑system commands by manipulating parameters such as pppUserName, pptpUserName, or L2TPUserName. This can be used to take full control of the affected router, alter its configuration, or pivot to other devices on the network.

The vulnerability affects the Edimax BR‑6478AC V2 router running firmware version 1.23. The router’s advertised model is the BR‑6478AC V2, a consumer‑grade wireless access point or repeater.

The CVSS score of 5.3 indicates a moderate severity, but the flaw is exploitable remotely over the internet with no authentication required. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, yet a public exploit is documented, so the likelihood of an active attack remains uncertain but non‑negligible. The attack vector is network‑based through the exposed web interface, and any device reachable from that interface can be compromised without further prerequisites.