CVE-2026-12807 Overview
CVE-2026-12807 is a command injection vulnerability in the Edimax BR-6478AC V2 router running firmware version 1.23. The flaw resides in the setWAN function within /goform/setWAN, part of the POST request handler. Attackers can manipulate the pppUserName, pptpUserName, or L2TPUserName parameters to inject operating system commands. The issue is remotely exploitable over the network and requires only low-level privileges. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-74] for improper neutralization of special elements in output.
Critical Impact
Authenticated remote attackers can inject arbitrary commands into the router operating system through WAN configuration parameters, with public proof-of-concept material available.
Affected Products
- Edimax BR-6478AC V2 router
- Firmware version 1.23
- /goform/setWAN POST request handler
Discovery Timeline
- 2026-06-21 - CVE-2026-12807 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2026-12807
Vulnerability Analysis
The vulnerability exists in the setWAN function exposed at the /goform/setWAN endpoint. The handler processes WAN configuration submitted via HTTP POST requests. Three user-controlled parameters — pppUserName, pptpUserName, and L2TPUserName — are passed to the underlying shell without sufficient neutralization of metacharacters. Submitting shell metacharacters in any of these fields causes the device to execute attacker-controlled commands in the context of the web management process. According to the disclosed EPSS data, the probability of exploitation in the wild is approximately 1.18% (63.8 percentile).
Root Cause
The root cause is improper neutralization of special elements within values passed from the HTTP request to a downstream OS command interpreter [CWE-74]. The setWAN handler concatenates user-supplied username strings into a system command without escaping or argument-list separation. Embedded characters such as ;, |, `, or $() break out of the intended argument and execute additional commands.
Attack Vector
An attacker who can reach the router's management interface and possesses a low-privilege session submits a crafted POST request to /goform/setWAN. The malicious payload is placed inside one of the affected username fields. When the firmware invokes the shell to apply the WAN configuration, the injected commands run on the device. Because the management interface can be exposed to the LAN or, in misconfigured deployments, to the WAN, the attack surface extends across both internal and remote scenarios.
No verified exploit code is reproduced here. Technical details and a proof-of-concept walkthrough are documented in the Notion security write-up and the VulDB CVE-2026-12807 entry.
Detection Methods for CVE-2026-12807
Indicators of Compromise
- HTTP POST requests to /goform/setWAN containing shell metacharacters (;, |, `, $() in pppUserName, pptpUserName, or L2TPUserName fields.
- Unexpected child processes spawned by the router web management binary following WAN configuration changes.
- Outbound connections from the router to unfamiliar IP addresses immediately after /goform/setWAN requests.
Detection Strategies
- Inspect HTTP request bodies destined for /goform/setWAN and alert on non-alphanumeric characters in PPP, PPTP, and L2TP username parameters.
- Baseline normal administrative activity on the management VLAN and flag POST requests to WAN configuration endpoints from non-admin hosts.
- Correlate router syslog entries showing WAN reconfiguration with subsequent shell or networking command activity.
Monitoring Recommendations
- Forward router and gateway logs to a centralized log platform and retain administrative HTTP requests for review.
- Monitor for repeated authentication attempts followed by /goform/setWAN submissions, which can indicate credential-stuffing combined with exploitation.
- Track changes to WAN configuration outside of approved change windows.
How to Mitigate CVE-2026-12807
Immediate Actions Required
- Restrict access to the router's web administration interface to trusted management hosts only and disable WAN-side management.
- Change default and weak administrative credentials, since exploitation requires authenticated access at a low privilege level.
- Place affected Edimax BR-6478AC V2 devices behind a segmented network or replace them in environments where remote administration is required.
Patch Information
No vendor patch is available. The vendor was contacted regarding this disclosure but did not respond. Refer to the VulDB advisory for CVE-2026-12807 for updates on vendor remediation status.
Workarounds
- Disable PPPoE, PPTP, and L2TP WAN modes if not required, eliminating the code paths that process the vulnerable parameters.
- Block external access to /goform/setWAN at the network perimeter or via an upstream firewall.
- Replace end-of-life Edimax BR-6478AC V2 devices with a currently supported router that receives security updates.
# Example: block external access to the management interface at an upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
# Permit only the management subnet
iptables -I FORWARD -p tcp -s 10.0.10.0/24 -d <router_ip> --dport 443 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
