CVE-2026-9440: Edimax BR-6478AC RCE Vulnerability

CVE-2026-9440 Overview

CVE-2026-9440 is a command injection vulnerability in the Edimax BR-6478AC router running firmware version 1.23. The flaw resides in the formAccept function within /goform/formAccept, part of the device's POST request handler. Attackers can manipulate the submit-url argument to inject operating system commands that execute in the context of the web management process. The attack is exploitable remotely over the network and requires low-level privileges on the device. A public exploit has been disclosed, and the vendor did not respond to disclosure attempts. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact

Authenticated attackers can inject arbitrary operating system commands through the submit-url POST parameter, gaining command execution on affected Edimax BR-6478AC routers running firmware 1.23.

Affected Products

• Edimax BR-6478AC firmware 1.23
• Component: POST Request Handler (/goform/formAccept)
• Vulnerable function: formAccept

Discovery Timeline

• 2026-05-25 - CVE-2026-9440 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9440

Vulnerability Analysis

The vulnerability exists in the formAccept handler exposed through /goform/formAccept on the Edimax BR-6478AC web administration interface. The handler accepts a submit-url parameter through HTTP POST requests but does not sanitize shell metacharacters before passing the value to a downstream system call. An attacker who can reach the management interface and supply credentials can append shell operators to the parameter and have them interpreted by the underlying shell. The result is command execution under the privileges of the web server process, which on consumer routers typically runs as root. The exploit is publicly available, increasing the likelihood of opportunistic abuse against exposed devices.

Root Cause

The root cause is improper neutralization of special elements passed to downstream components, tracked as [CWE-74]. The formAccept function concatenates the attacker-controlled submit-url value into a command string without escaping or validating shell metacharacters such as ;, |, &, or backticks. The firmware lacks an allow-list for permitted URL characters and does not use safer execution primitives that separate program arguments from a shell interpreter.

Attack Vector

Exploitation requires network access to the router's HTTP management interface and a valid low-privileged session. The attacker sends a crafted POST request to /goform/formAccept with a malicious submit-url value containing injected shell commands. Because many BR-6478AC deployments expose the management interface on the LAN and some on the WAN, internal attackers and remote attackers behind a misconfigured port forward can both reach the endpoint. Successful exploitation yields arbitrary command execution, enabling persistence, traffic interception, lateral movement, or recruitment into a botnet. The vulnerability mechanism is described in the Notion technical writeup and the VulDB entry #365421.

Detection Methods for CVE-2026-9440

Indicators of Compromise

• HTTP POST requests to /goform/formAccept containing shell metacharacters (;, |, &, $(), backticks) in the submit-url parameter.
• Unexpected outbound connections from the router to attacker infrastructure following management interface access.
• New or modified processes on the device that do not match the standard firmware baseline.

Detection Strategies

• Inspect web server and reverse proxy logs in front of router management interfaces for POST requests to /goform/formAccept with abnormal submit-url values.
• Deploy network intrusion detection signatures that flag shell metacharacters within form parameters destined for embedded device management endpoints.
• Correlate router authentication events with subsequent outbound DNS or HTTP traffic that does not match normal device behavior.

Monitoring Recommendations

• Forward syslog from the BR-6478AC and any upstream firewall to a centralized logging platform for retention and correlation.
• Alert on any administrative access to the router originating from non-administrative subnets or external addresses.
• Periodically baseline firmware version and configuration to detect unauthorized changes resulting from command execution.

How to Mitigate CVE-2026-9440

Immediate Actions Required

• Restrict access to the router web management interface to trusted administrative hosts only, and disable any WAN-side management.
• Change default and weak credentials on the device, since exploitation requires authenticated access.
• Audit the device for signs of compromise, including unexpected services, modified configuration, and unknown outbound connections.

Patch Information

No vendor patch is available. The Edimax security team did not respond to disclosure attempts according to the VulDB advisory. Organizations should treat the BR-6478AC firmware 1.23 as unsupported for this issue and plan replacement or network-level compensating controls until the vendor releases fixed firmware.

Workarounds

• Place the router management interface behind a VPN or jump host so that /goform/formAccept cannot be reached directly from untrusted networks.
• Block inbound HTTP/HTTPS to the device on the WAN interface and on guest VLANs through upstream firewall rules.
• Consider replacing affected BR-6478AC units with a supported model that receives security updates if no firmware fix is published.

# Example upstream firewall rule to restrict router admin access
# Replace 192.0.2.10 with the trusted admin workstation IP
# Replace 192.0.2.1 with the router LAN IP
iptables -A FORWARD -p tcp -s 192.0.2.10 -d 192.0.2.1 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP