CVE-2026-10166: Edimax BR-6478AC POST Request formWlbasic command injection
A vulnerability was determined in Edimax BR-6478AC 1.23. The affected element is the function formWlbasic of the file /goform/formWlbasic of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/wan web management (remote administration) so the device's POST handlers are not reachable from untrusted networks. If disabling is not possible, restrict management to the LAN only.
Edimax BR-6478AC web management remote_management = disabled - Compensating control
At the network perimeter or on internal segmentation devices, block or restrict access to the device's web interface and specifically the /goform/formWlbasic endpoint. Implement firewall/ACL or WAF rules to allow management traffic only from trusted IPs and to block POST requests to /goform/formWlbasic.
- Operational
Isolate any potentially affected Edimax BR-6478AC devices from untrusted networks, review device logs for signs of exploitation, perform a factory reset if compromise is suspected, and change administrative credentials. Reconfigure the device only from a trusted, isolated management network.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10166?
The severity of CVE-2026-10166 is medium with a CVSS score of 6.3.
What type of vulnerability is CVE-2026-10166?
CVE-2026-10166 is a command injection vulnerability.
How does CVE-2026-10166 affect the Edimax BR-6478AC?
CVE-2026-10166 allows remote attackers to inject commands through the formWlbasic function when manipulating the rootAPmac argument.
How do I fix CVE-2026-10166?
To fix CVE-2026-10166, update the Edimax BR-6478AC firmware to the latest version that addresses this vulnerability.
Can CVE-2026-10166 be exploited remotely?
Yes, CVE-2026-10166 can be exploited remotely by sending specially crafted POST requests.