A remote attacker can exploit the stainfo function in the /goform/stainfo component of Edimax BR‑6478AC V2 1.23 by sending a crafted POST request. The malicious input is executed as a shell command on the device, providing the attacker with the ability to run arbitrary code and potentially take full control of the router. The vulnerability falls under CWE‑74 and CWE‑77 and is rated CVSS 5.3, indicating moderate severity due to the direct execution of commands without proper validation.

Vulnerable devices are the Edimax BR‑6478AC V2 routers, specifically firmware version 1.23. No other versions or extended product lines are listed as affected in the CNA data.

The CVSS score of 5.3 reflects a moderate risk, but because the exploit can be triggered remotely without additional privileges and is publicly disclosed, the likelihood of real-world exploitation is non‑negligible. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attacks would target the unused or non‑authenticated /goform/stainfo endpoint, implying that any host with network reach to the router is potentially vulnerable.