CVE-2026-9379 Overview
CVE-2026-9379 is a command injection vulnerability in the Edimax BR-6675nD wireless router, firmware version 1.12. The flaw resides in the formWpsStart function within /goform/formWpsStart, which handles POST requests to the device. Attackers can manipulate the pinCode argument to inject operating system commands processed by the underlying shell. The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output). Public exploit details have been released, and the vendor did not respond to disclosure attempts.
Critical Impact
Authenticated remote attackers can inject arbitrary shell commands through the WPS PIN parameter, compromising the integrity and confidentiality of the router.
Affected Products
- Edimax BR-6675nD wireless router
- Firmware version 1.12
- /goform/formWpsStart POST request handler
Discovery Timeline
- 2026-05-24 - CVE-2026-9379 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9379
Vulnerability Analysis
The vulnerability exists in the formWpsStart request handler exposed by the router's embedded web server. The handler accepts POST data including the pinCode parameter, which is intended to carry a WPS PIN value. Instead of validating the input as a numeric PIN, the firmware passes the value into a system shell invocation without sanitization. This allows shell metacharacters such as semicolons, backticks, and pipes to break out of the intended command context. The exploitability is rated network-accessible with low attack complexity, and a working exploit has been made public. EPSS data lists the exploitation probability at 1.077% with a 78.092 percentile ranking, indicating elevated attention relative to peer CVEs.
Root Cause
The root cause is improper neutralization of special elements in a downstream component, classified as CWE-74. The formWpsStart function trusts the pinCode POST parameter and concatenates it into a shell command. No allow-list, length check, or character filter prevents injection of additional commands.
Attack Vector
The attack vector is network-based. An attacker who can reach the router's HTTP management interface and has low-privilege credentials sends a crafted POST request to /goform/formWpsStart. The injected payload within pinCode executes with the privileges of the web server process, typically root on embedded routers. Routers exposed to the WAN dramatically increase the exposure window.
No verified exploit code is reproduced here. Refer to the Notion technical write-up and VulDB entry 365342 for the published proof-of-concept and parameter details.
Detection Methods for CVE-2026-9379
Indicators of Compromise
- POST requests to /goform/formWpsStart containing shell metacharacters such as ;, |, &, $(), or backticks in the pinCode field.
- Unexpected outbound connections from the router to attacker-controlled hosts following WPS-related HTTP traffic.
- New or modified processes spawned by the router's web server (httpd or boa) outside of normal WPS workflows.
Detection Strategies
- Inspect HTTP request bodies destined for the router's management interface and alert on non-numeric content in the pinCode parameter.
- Correlate WPS-related POST requests with subsequent DNS lookups or TCP connections originating from the router's management VLAN.
- Apply network intrusion detection signatures targeting command injection patterns against Edimax /goform/ endpoints.
Monitoring Recommendations
- Log all administrative POST requests to the Edimax web interface and forward them to a centralized SIEM for analysis.
- Monitor for authentication events on the router followed by anomalous configuration changes or firmware actions.
- Track router CPU and process metrics via SNMP to identify unexpected spawned binaries.
How to Mitigate CVE-2026-9379
Immediate Actions Required
- Restrict access to the router's HTTP administration interface to trusted management subnets only.
- Disable WPS functionality if not strictly required for device provisioning.
- Rotate administrative credentials and enforce strong passwords to limit low-privilege account abuse.
- Block the device's management interface from the WAN side and disable remote administration.
Patch Information
No vendor patch is available. The vendor was contacted prior to disclosure and did not respond. Organizations operating the Edimax BR-6675nD 1.12 should plan replacement with a supported device, since further security updates are unlikely.
Workarounds
- Place the router behind a firewall that filters POST requests to /goform/formWpsStart from untrusted sources.
- Segment vulnerable routers onto isolated management VLANs with strict ACLs.
- Replace the affected device with a vendor-supported model that receives current firmware updates.
# Example firewall rule to block external access to the router admin interface
iptables -A INPUT -p tcp --dport 80 -i wan0 -j DROP
iptables -A INPUT -p tcp --dport 443 -i wan0 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
