A firmware vulnerability in EDIMAX BR‑6428nS V3 1.15 permits an authenticated attacker on the local network to send specially crafted input to the WLAN configuration interface. Because input validation is insufficient, the attacker can inject system commands, a classic command‑injection flaw (CWE‑77), gaining the ability to execute arbitrary code on the device and compromise its integrity. The flaw does not, however, provide a direct attack path from outside the local network.

The affected device is the EDIMAX BR‑6428nS router running firmware version 1.15. No other vendors or product variants are listed in the CNA data. Users of this router should confirm that they are deploying the listed build and be aware that no firmware older than 1.15 or alternative model numbers have been reported as vulnerable.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1 % reflects a very low historical exploitation probability. The vulnerability requires local authentication, implying that an attacker must already have network access or compromised a local user account. Because the flaw is not listed in CISA KEV, no confirmed public exploits exist yet, but the potential for destructive impact warrants prompt attention.