CVE-2026-9441: Edimax BR-6478AC RCE Vulnerability

CVE-2026-9441 Overview

CVE-2026-9441 is a command injection vulnerability in the Edimax BR-6478AC wireless router running firmware version 1.23. The flaw resides in the formiNICbasic function processed by the /goform/formiNICbasic POST request handler. Attackers can manipulate the rootAPmac argument to inject arbitrary operating system commands. The attack is initiated remotely and requires only low-level privileges on the device. A public exploit has been released, increasing exposure risk for unpatched units. The vendor was contacted prior to disclosure but did not respond, leaving no official remediation available at publication time.

Critical Impact

Authenticated remote attackers can execute arbitrary commands on affected Edimax BR-6478AC routers through the rootAPmac POST parameter, with no vendor patch available.

Affected Products

• Edimax BR-6478AC firmware version 1.23
• Edimax BR-6478ACV2 (referenced in third-party advisory)
• Devices exposing the /goform/formiNICbasic POST handler

Discovery Timeline

• 2026-05-25 - CVE-2026-9441 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9441

Vulnerability Analysis

The vulnerability is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component. The formiNICbasic handler accepts a rootAPmac argument from POST requests and passes the value into a shell context without sanitization. An attacker who supplies shell metacharacters in this parameter can append arbitrary commands to the executed string. Successful exploitation yields command execution in the context of the web management process, typically running with elevated privileges on embedded Linux router firmware. The attack vector is network-based and requires low-privilege authentication to reach the vulnerable handler.

Root Cause

The root cause is missing input validation and sanitization on the rootAPmac field within the /goform/formiNICbasic endpoint. The handler concatenates user-supplied data into system command invocations, allowing injected operators such as semicolons, backticks, or pipe characters to break out of the intended argument context.

Attack Vector

An attacker sends a crafted HTTP POST request to /goform/formiNICbasic containing a malicious rootAPmac value. The injected payload is interpreted by the underlying shell, executing attacker-controlled commands. Because the device exposes the management interface over the network, the flaw is reachable remotely wherever the web administration service is accessible. The public release of exploit details lowers the barrier for opportunistic attacks against exposed devices. Full technical reproduction steps are documented in the Notion Resource Overview and VulDB Vulnerability #365422.

Detection Methods for CVE-2026-9441

Indicators of Compromise

• POST requests to /goform/formiNICbasic containing shell metacharacters (;, |, &&, backticks) in the rootAPmac parameter.
• Unexpected outbound connections originating from the router's management interface.
• Modified router configuration, new accounts, or unfamiliar processes on the device.

Detection Strategies

• Inspect HTTP request logs on or in front of the router for anomalous values in the rootAPmac POST field.
• Deploy network intrusion detection signatures matching command injection patterns targeting /goform/formiNICbasic.
• Baseline router management traffic and alert on POST requests to administrative endpoints from non-administrator sources.

Monitoring Recommendations

• Forward router syslog and authentication events to a centralized log platform for correlation.
• Monitor for unusual DNS queries or outbound traffic from the router's management VLAN.
• Track EPSS movement for CVE-2026-9441 to gauge changes in exploitation likelihood as public exploit usage spreads.

How to Mitigate CVE-2026-9441

Immediate Actions Required

• Remove the Edimax BR-6478AC management interface from any WAN-facing exposure and restrict LAN access by source IP.
• Change default and administrative credentials to limit access to the vulnerable authenticated handler.
• Segment the router from sensitive internal networks until a vendor fix is available.

Patch Information

No vendor patch is currently available. Edimax did not respond to disclosure attempts, and no security advisory or firmware update addressing formiNICbasic has been published. Organizations should monitor the Edimax support portal and reference VulDB Vulnerability #365422 for updates.

Workarounds

• Disable remote administration features on affected Edimax BR-6478AC devices.
• Place the device behind a firewall that filters inbound traffic to TCP ports used by the web management interface.
• Replace end-of-support hardware lacking vendor maintenance with a supported router platform that receives security updates.

# Configuration example: restrict management interface to a trusted admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP