CVE-2026-12809: Edimax BR-6478AC V2 POST Request wiz_5in1_redirect command injection
A vulnerability was identified in Edimax BR-6478AC V2 1.23. Affected is the function wiz5in1redirect of the file /goform/wiz5in1redirect of the component POST Request Handler. Such manipulation of the argument newpass leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12809?
The severity of CVE-2026-12809 is medium, rated at 6.3.
How do I fix CVE-2026-12809?
To fix CVE-2026-12809, update the firmware of the Edimax BR-6478AC V2 device to the latest version available.
What type of vulnerability is CVE-2026-12809?
CVE-2026-12809 is classified as a command injection vulnerability.
Can CVE-2026-12809 be exploited remotely?
Yes, CVE-2026-12809 can be exploited remotely due to its nature.
Which component of the Edimax BR-6478AC V2 is affected by CVE-2026-12809?
The affected component in the Edimax BR-6478AC V2 is the POST Request Handler, specifically the wiz_5in1_redirect function.