CVE-2026-12810: Edimax BR-6478AC V2 RCE Vulnerability

CVE-2026-12810 Overview

CVE-2026-12810 is a command injection vulnerability [CWE-74] in the Edimax BR-6478AC V2 wireless router running firmware version 1.23. The flaw resides in the mp function of the /goform/mp endpoint, which handles POST requests. An attacker can manipulate the command argument to inject arbitrary operating system commands. The attack is reachable over the network and requires low-level privileges. Public exploit code has been released, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can inject commands through the /goform/mp POST handler, potentially leading to unauthorized control of the affected router.

Affected Products

Edimax BR-6478AC V2 firmware 1.23
POST Request Handler component (/goform/mp)
mp function processing the command parameter

Discovery Timeline

2026-06-21 - CVE-2026-12810 published to the National Vulnerability Database (NVD)
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12810

Vulnerability Analysis

The vulnerability is a command injection issue affecting the mp function inside /goform/mp on the Edimax BR-6478AC V2 router. The endpoint processes HTTP POST requests and reads the command argument supplied by the client. Insufficient sanitization of that argument allows shell metacharacters to reach the underlying operating system shell. An attacker can therefore execute arbitrary commands in the context of the web server process, typically running with elevated privileges on embedded routers.

The exploit has been released publicly, increasing the likelihood of opportunistic scanning and abuse. The vendor was contacted prior to disclosure but provided no response, leaving administrators without an official patch at the time of publication.

Root Cause

The root cause is improper neutralization of special elements used in a downstream component [CWE-74]. The mp handler concatenates attacker-supplied input from the command parameter into a shell invocation without filtering metacharacters such as ;, |, &, or backticks. This pattern is common in embedded web management consoles that rely on system() or similar shell wrappers to invoke OS utilities.

Attack Vector

Exploitation requires sending a crafted POST request to /goform/mp with a malicious command parameter. The attack vector is the network, complexity is low, and only low-level privileges are required to reach the handler. Successful exploitation results in arbitrary command execution on the router, which can be used to alter configurations, intercept traffic, or pivot into the internal network.

For technical specifics, refer to the Notion Resource Page and the VulDB CVE-2026-12810 entry. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2026-12810

Indicators of Compromise

POST requests to /goform/mp containing shell metacharacters such as ;, |, &&, or backticks in the command parameter
Unexpected outbound connections originating from the router's management interface
New or modified processes spawned by the HTTP daemon on the device

Detection Strategies

Inspect HTTP traffic destined for the router's web management interface and alert on POST bodies targeting /goform/mp with suspicious payloads in command
Baseline normal administrative traffic and flag deviations such as off-hours configuration requests from unusual source IPs
Correlate router authentication logs with subsequent inbound POSTs to /goform/mp to identify abuse of low-privilege accounts

Monitoring Recommendations

Forward router syslog and authentication events to a centralized SIEM for correlation
Monitor DNS queries and outbound flows from the router for command-and-control indicators
Track firmware version inventory and alert when devices running BR-6478AC V2 firmware 1.23 appear on the network

How to Mitigate CVE-2026-12810

Immediate Actions Required

Restrict access to the router's web management interface to trusted management VLANs or specific administrative IPs
Disable remote administration over WAN if it is currently enabled
Rotate all administrative credentials and enforce strong, unique passwords to reduce the value of stolen low-privilege accounts
Place affected devices behind a network access control list (ACL) that blocks POST requests to /goform/mp from untrusted sources

Patch Information

At the time of publication, no vendor patch is available. According to the disclosure, Edimax did not respond to the researcher. Administrators should monitor the Edimax support site for future firmware releases addressing the BR-6478AC V2 platform and consider replacing end-of-support devices with currently maintained models.

Workarounds

Segment vulnerable routers onto an isolated management network with strict ingress filtering
Use a reverse proxy or upstream firewall to block requests containing shell metacharacters in the command parameter of /goform/mp
Disable unused services on the router and limit administrative sessions to wired connections only

bash

# Example firewall rule to block external access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --algo bm \
  --string "/goform/mp" -j DROP