CVE-2026-10127: Edimax BR-6478AC POST Request formStaDrvSetup command injection
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/ WAN access to the web management interface (remote administration) so the POST endpoint /goform/formStaDrvSetup is not reachable from untrusted networks.
Edimax BR-6478AC management interface remote_admin / WAN web access = disabled - Compensating control
At the network perimeter, restrict access to the device's management interface to a small set of trusted IP addresses using firewall rules or VPN-only access; block all other inbound traffic to ports providing the web interface.
- Compensating control
Deploy a WAF or reverse proxy rule to block or drop HTTP POST requests to the path /goform/formStaDrvSetup and/or inspect and block requests containing suspicious characters in the rootAPmac parameter to prevent command injection attempts.
- Operational
Monitor device logs and network traffic for POST requests to /goform/formStaDrvSetup and signs of exploitation of the rootAPmac parameter. If compromise is suspected, isolate the device from the network, perform a factory reset or rebuild, and apply any vendor-supplied firmware updates when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10127?
CVE-2026-10127 has a medium severity score of 6.3.
What type of vulnerability is CVE-2026-10127?
CVE-2026-10127 is a command injection vulnerability affecting the Edimax BR-6478AC.
How does the CVE-2026-10127 vulnerability occur?
The vulnerability occurs due to improper handling of the argument rootAPmac in the formStaDrvSetup function.
How can I mitigate CVE-2026-10127?
Mitigation for CVE-2026-10127 includes applying patches or updates provided by Edimax for the BR-6478AC.
Can CVE-2026-10127 be exploited remotely?
Yes, CVE-2026-10127 can be exploited remotely due to the nature of the command injection flaw.