A remote attacker can deliver a specially crafted HTTP POST request to the /goform/mp endpoint of the Edimax BR‑6228NC device. The command parameter is not properly validated, enabling arbitrary shell commands to be executed on the device. This can lead to full compromise of the device, including data exfiltration, service disruption, or use as a pivot point for further attacks. The flaw is associated with the weaknesses of improper command handling (CWE‑74) and lack of input validation for command execution (CWE‑77).

Edimax BR‑6228NC routers running firmware version 1.22 are affected. No other vendors or product versions are listed as vulnerable.

The CVSS base score is 5.3, indicating moderate severity. EPSS data is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but an exploit is publicly available and can be performed from anywhere on the network that can reach the device's management interface. The attack vector is remote, exploiting the HTTP POST API exposed by the router.