Description
A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-06-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is found in the mp function of the /goform/mp endpoint in Edimax BR-6478AC V2 firmware 1.23. By manipulating the "command" parameter in a POST request, an attacker can inject arbitrary system commands. This injection allows remote execution of commands on the device, potentially granting full control to the attacker.

Affected Systems

Edimax BR-6478AC V2 firmware version 1.23 is affected. No other vendor or product versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, but the exploit is publicly released and can be triggered remotely via a simple POST request to /goform/mp, without any authentication. The vulnerability is not currently listed in the CISA KEV catalog. Consequently, any unpatched device accessible over the network is at risk of compromise.

Generated by OpenCVE AI on June 21, 2026 at 23:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the device to a firmware version that includes the fix for the mp command injection flaw
  • Restrict network access to the device by configuring firewall rules or VLAN segmentation so that only trusted IPs can reach the /goform/mp endpoint
  • Monitor HTTP traffic for anomalous POST requests to /goform/mp and log or block suspicious activity

Generated by OpenCVE AI on June 21, 2026 at 23:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 21 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Edimax BR-6478AC V2 1.23. Affected by this vulnerability is the function mp of the file /goform/mp of the component POST Request Handler. Performing a manipulation of the argument command results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Edimax BR-6478AC V2 POST Request mp command injection
First Time appeared Edimax
Edimax br-6478ac V2
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:edimax:br-6478ac_v2:*:*:*:*:*:*:*:*
Vendors & Products Edimax
Edimax br-6478ac V2
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Edimax Br-6478ac V2
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-06-21T21:45:07.455Z

Reserved: 2026-06-21T04:20:02.194Z

Link: CVE-2026-12810

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-21T23:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')