CVE-2026-8777 Overview
CVE-2026-8777 is a command injection vulnerability in the Edimax BR-6428NS wireless router running firmware version 1.10. The flaw resides in the formStaDrvSetup function within /goform/formStaDrvSetup, part of the POST request handler. Attackers can manipulate the stadrv_ssid argument to inject arbitrary operating system commands. The issue is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The exploit has been published, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can inject operating system commands through the stadrv_ssid parameter, enabling code execution on affected Edimax BR-6428NS routers.
Affected Products
- Edimax BR-6428NS wireless router
- Firmware version 1.10
- formStaDrvSetup POST request handler component
Discovery Timeline
- 2026-05-18 - CVE-2026-8777 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-8777
Vulnerability Analysis
The vulnerability exists in the formStaDrvSetup handler exposed at the /goform/formStaDrvSetup endpoint on the Edimax BR-6428NS router. The handler accepts the stadrv_ssid parameter from POST requests without proper neutralization of shell metacharacters. An attacker who can reach the device web interface and submit a crafted request can append shell commands to the parameter value. The injected commands execute in the context of the router's web service, typically running with elevated privileges on embedded Linux firmware.
The weakness maps to CWE-74, covering injection flaws where untrusted input flows into a downstream component without sanitization. The EPSS score is 1.058% with a percentile of 77.863, indicating measurable exploitation interest relative to other vulnerabilities.
Root Cause
The root cause is missing input validation on the stadrv_ssid POST parameter. The firmware passes the user-supplied value into a system command invocation, likely via system(), popen(), or a similar shell-executing function. Shell metacharacters such as ;, |, &, and backticks are not stripped or escaped before execution.
Attack Vector
The attack is network-reachable and requires low privileges according to the CVSS 4.0 vector. An attacker submits a POST request to /goform/formStaDrvSetup with a stadrv_ssid value containing injected shell commands. No user interaction is required. The vendor was contacted but did not respond, and a public exploit is available through VulDB entry #364402 and the Notion technical writeup.
No verified proof-of-concept code is reproduced here. Refer to the published references for technical details of the request format and payload construction.
Detection Methods for CVE-2026-8777
Indicators of Compromise
- POST requests to /goform/formStaDrvSetup containing shell metacharacters (;, |, &, $(), backticks) in the stadrv_ssid parameter
- Unexpected outbound connections originating from the router management interface
- Unusual processes spawned by the router web daemon following SSID configuration changes
Detection Strategies
- Inspect HTTP request bodies destined for /goform/formStaDrvSetup and flag non-printable or shell-syntax characters in stadrv_ssid
- Correlate router configuration POST requests with subsequent egress traffic to unknown destinations
- Baseline normal SSID configuration changes and alert on bursts of POST requests to the same endpoint
Monitoring Recommendations
- Forward router and network device logs to a centralized SIEM for retention and analysis
- Monitor for firmware integrity changes and unauthorized configuration modifications
- Enable network segmentation logging between management VLANs and user networks to surface lateral movement
How to Mitigate CVE-2026-8777
Immediate Actions Required
- Restrict access to the router web management interface to trusted management VLANs only
- Disable remote WAN-side administration if currently enabled on the BR-6428NS
- Rotate administrative credentials, since the CVSS vector indicates low privileges are required for exploitation
- Treat the device as end-of-support and plan replacement with a vendor-supported model, given the vendor's non-response
Patch Information
No vendor patch is available. According to the published disclosure, the vendor was contacted early but did not respond. Organizations operating Edimax BR-6428NS devices on firmware 1.10 should plan device replacement or compensating controls.
Workarounds
- Place the router behind a network firewall that blocks inbound HTTP/HTTPS to the management interface from untrusted networks
- Apply ACLs that limit /goform/* endpoint access to specific administrator IP addresses
- Decommission affected devices and replace with supported hardware that receives security updates
# Example firewall rule restricting management access to a trusted host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
