CVE-2026-8774 Overview
CVE-2026-8774 is a command injection vulnerability in the Edimax BR-6228NC wireless router running firmware version 1.22. The flaw resides in the mp function handling POST requests to the /goform/mp endpoint. An authenticated remote attacker can manipulate the command argument to inject and execute arbitrary operating system commands on the device. A public exploit exists, and the vendor did not respond to disclosure attempts. The vulnerability is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.
Critical Impact
Remote attackers with low-privilege access can execute arbitrary commands on affected Edimax BR-6228NC routers, potentially gaining control of the device and pivoting into the connected network.
Affected Products
- Edimax BR-6228NC firmware version 1.22
- /goform/mp POST request handler
- mp function processing the command parameter
Discovery Timeline
- 2026-05-18 - CVE-2026-8774 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-8774
Vulnerability Analysis
The vulnerability exists in the request handler exposed at /goform/mp on the Edimax BR-6228NC router web management interface. The mp function reads the command argument from POST request bodies without sanitizing shell metacharacters. The router passes attacker-controlled input directly to an underlying system command execution routine. This permits arbitrary OS command execution in the context of the web server process, which typically runs with elevated privileges on embedded SOHO routers.
The issue is classified as [CWE-74] — improper neutralization of special elements in output used by a downstream component. According to the published CVSS 4.0 vector, the attack is network-reachable and requires low-level privileges but no user interaction. The Exploit Prediction Scoring System (EPSS) places this vulnerability at the 77.8 percentile, indicating elevated exploitation likelihood relative to the broader CVE population.
Root Cause
The root cause is missing input validation and sanitization on the command parameter inside the mp handler. The firmware concatenates user-supplied data into a shell command string and invokes it without escaping. Shell metacharacters such as ;, |, &&, and backticks are interpreted by the underlying interpreter, allowing arbitrary commands to be chained onto legitimate input.
Attack Vector
An attacker sends a crafted HTTP POST request to /goform/mp containing a malicious command parameter. The request requires low-privilege authentication to the router's management interface. Once processed, injected commands execute on the embedded Linux operating system. Refer to the VulDB Vulnerability Detail and the Notion writeup on EDIMAX BR6228NC for proof-of-concept details.
Detection Methods for CVE-2026-8774
Indicators of Compromise
- POST requests to /goform/mp containing shell metacharacters (;, |, &, backticks, $()) in the command parameter.
- Unexpected outbound connections originating from the router's management plane.
- New or modified processes on the router consistent with downloader, reverse shell, or botnet client activity.
Detection Strategies
- Inspect HTTP traffic destined to the router's web interface for anomalous command parameter values in /goform/mp POST bodies.
- Alert on authentication followed immediately by POST requests containing non-printable or metacharacter payloads.
- Correlate router log entries with outbound DNS or HTTP requests to non-corporate destinations.
Monitoring Recommendations
- Restrict access to the router management interface to known administrative hosts and monitor authentication events.
- Capture and review router syslog output for unusual command execution or service restarts.
- Baseline traffic from network infrastructure devices and flag deviations from expected protocols and destinations.
How to Mitigate CVE-2026-8774
Immediate Actions Required
- Disable remote administration of the BR-6228NC over WAN and restrict LAN-side management to trusted hosts only.
- Change default and weak credentials on the router management interface to limit the low-privilege precondition.
- Segment the affected router away from sensitive network assets until mitigated or replaced.
Patch Information
No vendor patch is available. The vendor was contacted but did not respond to the disclosure. Organizations operating the Edimax BR-6228NC firmware 1.22 should consider replacing the device with a supported model. Track updates via the VulDB Vulnerability Detail record.
Workarounds
- Block access to /goform/mp at an upstream firewall or reverse proxy where feasible.
- Place the router behind a network access control layer that restricts management plane reachability to a dedicated VLAN.
- Decommission the BR-6228NC and migrate to actively supported networking hardware where a vendor patch lifecycle exists.
# Example: restrict router management interface to a single admin host using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -s 192.0.2.50 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
