The vulnerability resides in the Edimax BR-6428NS firmware version 1.10, where the POST request handler for /goform/formWlanM accepts unsanitised data for a large set of parameters. By sending a crafted POST request, an attacker can inject system commands into the device’s operating system, resulting in arbitrary command execution. This flaw is categorized as CWE‑74 (Input Validation) and CWE‑77 (Command Injection).

The affected system is the Edimax BR-6428NS, firmware version 1.10. No additional vendors or product variants are listed in the CVE entry.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation likelihood is unknown. Nevertheless, the flaw can be leveraged remotely over the device’s web interface, giving an attacker the ability to run arbitrary commands and potentially compromise the device’s confidentiality, integrity, and availability.