CVE-2026-9400: Edimax BR-6675nD RCE Vulnerability

CVE-2026-9400 Overview

CVE-2026-9400 is a command injection vulnerability in the Edimax BR-6675nD wireless router running firmware version 1.12. The flaw resides in the formUSBStorage function exposed through the /goform/formUSBStorage endpoint of the POST request handler. An attacker can manipulate the sub_dir argument to inject operating system commands that the router executes with elevated privileges. The vulnerability is exploitable remotely over the network and requires only low-privilege authentication. A public exploit has been disclosed. The vendor was contacted before public disclosure but did not respond, leaving affected devices without an official fix.

Critical Impact
Authenticated remote attackers can inject arbitrary commands through the sub_dir parameter, potentially gaining shell access to the router and using it as a foothold into the internal network.

Affected Products

Edimax BR-6675nD wireless router
Firmware version 1.12
formUSBStorage POST request handler component

Discovery Timeline

2026-05-24 - CVE-2026-9400 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9400

Vulnerability Analysis

The vulnerability is a command injection flaw classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The formUSBStorage handler processes POST requests submitted to /goform/formUSBStorage and consumes the sub_dir parameter without proper sanitization. Because the parameter is passed into a shell context, an attacker can append shell metacharacters such as ;, &&, or backticks to execute arbitrary commands on the router's underlying Linux operating system.

The EPSS score is 1.058% at the 77.9 percentile, indicating measurable interest in exploitation relative to the broader CVE population. A public proof-of-concept is referenced through VulDB entry 365381 and supporting third-party documentation.

Root Cause

The root cause is missing input validation and neutralization in the sub_dir argument handling logic. The handler concatenates user-supplied input directly into a system command string rather than using safe argument passing or strict allowlist validation. This is a recurring pattern in consumer SOHO router firmware where goform CGI handlers invoke shell utilities to manage USB storage mounts.

Attack Vector

The attack vector is network-based against the router's HTTP management interface. An attacker with low-privilege credentials submits a crafted POST request to /goform/formUSBStorage containing a malicious sub_dir value. The injected commands execute with the privileges of the web server process, which typically runs as root on embedded router firmware. If the management interface is exposed to the WAN, exploitation can occur from the internet. On LAN-restricted deployments, an attacker who already controls a client device can pivot to the router.

No verified exploitation code is reproduced here. Refer to the VulDB Vulnerability #365381 entry and the Notion Security Documentation for published technical details.

Detection Methods for CVE-2026-9400

Indicators of Compromise

POST requests to /goform/formUSBStorage containing shell metacharacters (;, |, &, `, $()) in the sub_dir parameter.
Unexpected outbound connections originating from the router's management IP, particularly to unfamiliar hosts on non-standard ports.
New or modified files in router-writable paths such as /tmp or /var following USB storage configuration activity.

Detection Strategies

Inspect HTTP request logs on upstream network devices for POST traffic to /goform/formUSBStorage and flag payloads containing command separators in sub_dir.
Deploy network IDS signatures that match command injection patterns against the Edimax goform URI path.
Correlate router authentication events with subsequent USB storage configuration changes to identify abnormal administrative activity.

Monitoring Recommendations

Restrict and audit access to the router's HTTP management interface, treating any WAN-side access as suspicious by default.
Monitor DNS traffic from the router itself for queries to attacker-controlled infrastructure indicative of post-exploitation command-and-control.
Enable syslog forwarding from the router to a centralized log store and alert on configuration changes outside scheduled maintenance windows.

How to Mitigate CVE-2026-9400

Immediate Actions Required

Disable remote (WAN) administration on the Edimax BR-6675nD and restrict the management interface to a trusted management VLAN.
Change default and weak administrator credentials, since exploitation requires low-privilege authentication.
Disconnect or isolate the device from production networks if it handles sensitive traffic, given that no vendor patch is available.

Patch Information

No vendor patch is available. According to the disclosure, Edimax was contacted prior to public release but did not respond. Organizations should track the VulDB Vulnerability #365381 record for any future vendor updates and consider replacing the BR-6675nD with a supported, actively maintained router model.

Workarounds

Place the router behind a network segmentation boundary that blocks untrusted access to TCP ports used by the management web interface.
Disable the USB storage feature if it is not required, reducing exposure of the formUSBStorage handler.
Apply Web Application Firewall or upstream proxy rules that drop requests to /goform/formUSBStorage containing shell metacharacters.

bash

# Example upstream firewall rule to block external access to the router management interface
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_iface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_iface> -j DROP