CVE-2026-9378 Overview
CVE-2026-9378 is a command injection vulnerability [CWE-74] affecting Edimax BR-6675nD firmware version 1.12. The flaw resides in the formHwSet function within /goform/formHwSet, part of the device's POST request handler. Attackers can manipulate the regDomain/ABandregDomain, nic0Addr, nic1Addr, wlanAddr, or inicAddr arguments to inject operating system commands. The attack is remotely exploitable and requires only low-privilege authentication. Public exploit details have been released, increasing the likelihood of opportunistic exploitation. The vendor was contacted prior to disclosure but did not respond, leaving devices without an official patch.
Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected Edimax BR-6675nD routers, leading to full device compromise.
Affected Products
- Edimax BR-6675nD router, firmware version 1.12
- The /goform/formHwSet POST request handler
- The formHwSet function processing hardware address parameters
Discovery Timeline
- 2026-05-24 - CVE-2026-9378 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9378
Vulnerability Analysis
The vulnerability sits in the formHwSet handler registered under /goform/formHwSet on the Edimax BR-6675nD web administration interface. The function processes POST parameters that represent hardware addresses and regulatory domain settings. Input received in regDomain/ABandregDomain, nic0Addr, nic1Addr, wlanAddr, and inicAddr is passed to a shell context without sanitization or argument escaping. An authenticated user can therefore append shell metacharacters to these parameters and execute commands under the privileges of the web server, typically root on consumer routers. Public disclosure of exploitation details on VulDB and a Notion writeup elevates the practical risk for exposed devices. EPSS data places the exploitation probability at 1.058% (77.9th percentile), reflecting active interest from opportunistic scanners.
Root Cause
The handler concatenates user-controlled POST values directly into command strings invoked by system()-style calls. This is a classic neutralization failure aligned with [CWE-74]: improper neutralization of special elements in output used by a downstream component. The router firmware lacks any allow-list validation for MAC address or regulatory domain fields, so shell separators such as ;, |, and backticks pass through unchanged.
Attack Vector
An attacker authenticates to the router's web interface, then issues a crafted POST request to /goform/formHwSet containing shell metacharacters in any of the affected parameters. The vulnerable function executes the appended commands during request processing. Because the firmware exposes management on the LAN by default and on the WAN in misconfigured deployments, the attack surface includes both internal pivots and internet-exposed routers. Public exploit material is referenced in the VulDB entry and Notion writeup. See the Notion Resource Guide and VulDB Vulnerability #365341 for technical specifics.
Detection Methods for CVE-2026-9378
Indicators of Compromise
- POST requests to /goform/formHwSet containing shell metacharacters such as ;, |, &, $(, or backticks within regDomain, nic0Addr, nic1Addr, wlanAddr, or inicAddr parameters
- Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative POST activity
- New or modified processes on the router not originating from the standard firmware image
Detection Strategies
- Inspect HTTP request logs at upstream proxies or firewalls for POST traffic to /goform/formHwSet and flag payloads containing characters outside the expected MAC address character set [0-9A-Fa-f:]
- Deploy network IDS rules that match the URI path combined with shell metacharacter patterns in the request body
- Baseline router management traffic and alert on administrative requests originating from non-administrative source addresses
Monitoring Recommendations
- Forward router syslog and authentication events to a centralized SIEM and correlate failed logins with subsequent POST activity to /goform/
- Monitor for unauthorized firmware modification or unexpected reboots on Edimax BR-6675nD devices
- Track DNS and outbound flow telemetry from network segments containing the affected routers for command-and-control beaconing
How to Mitigate CVE-2026-9378
Immediate Actions Required
- Restrict access to the router's web administration interface to trusted management VLANs and block WAN-side access to /goform/formHwSet
- Rotate administrative credentials and disable any default or shared accounts on affected devices
- Inventory all Edimax BR-6675nD 1.12 devices and isolate them from sensitive network segments pending replacement or compensating controls
Patch Information
No vendor patch is available. The vendor was contacted but did not respond to the disclosure. Organizations should consider decommissioning affected devices or replacing them with supported hardware. Refer to VulDB Vulnerability #365341 for ongoing tracking.
Workarounds
- Place the router behind a network firewall and permit administrative access only from a dedicated management host
- Disable remote management and ensure the WAN interface does not expose the HTTP administration service
- Apply strict ACLs limiting POST traffic to /goform/ paths to known administrator IP addresses
# Example: block WAN-side access to the vulnerable endpoint at an upstream firewall
iptables -I FORWARD -p tcp -d <router_ip> --dport 80 \
-m string --string "/goform/formHwSet" --algo bm -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
