Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-12807: Edimax BR-6478AC V2: Unauthenticated Command Injection via WAN Settings
CVE-2026-12807 · published 4 months ago
Summary
A security flaw in the Edimax BR-6478AC V2 router's WAN settings allows an attacker to execute unauthorized commands remotely. This could potentially give the attacker control over the router. We recommend checking with the router's manufacturer for an updated firmware to fix this issue.
Original advisory text
A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The manipulation of the argument pppUserNam...
A vulnerability was found in Edimax BR-6478AC V2 1.23. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The manipulation of the argument pppUserName/pptpUserName/L2TPUserName results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-74Injection
CWE-77Command Injection
Timeline
Published21 Jun 2026
Updated3 Nov 2026
First seen21 Jun 2026
Sources
CVE-2026-12807 · NVD
Track software like this
Free during beta