An unvalidated input in the POST handler of the Edimax BR‑6478AC V2 device allows an attacker to inject shell commands via the newpass parameter of the /goform/wiz_5in1_redirect endpoint. This flaw is a classic command injection (CWE‑74) that can lead to remote code execution and full compromise of the device. The vulnerability is exploitable over the network, and publicly available proof‑of‑concept code demonstrates that arbitrary commands can be executed with the privileges of the internal firmware process.

Product: Edimax BR‑6478AC V2 wireless access point, firmware 1.23. The issue resides in the wiz_5in1_redirect function of the POST request handler. Only devices running firmware version 1.23 are known to be vulnerable; no other firmware releases are confirmed to be affected.

The CVSS base score of 5.3 indicates a moderate severity, and with no EPSS data the likelihood of exploitation cannot be quantified, but publicly available exploits and the lack of a vendor response suggest a real risk. The vulnerability allows remote attackers to execute arbitrary commands without authentication, posing a high risk to confidentiality, integrity, and availability of the device. As it is not currently listed in CISA KEV, it is not yet a known exploited vulnerability in the wild, but the existence of ready‑to‑use exploits mandates immediate action.