CVE-2026-13561: Edimax EW-7478APC POST Request formiNICbasic os command injection
A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13561?
CVE-2026-13561 has a medium severity score of 6.3.
How do I fix CVE-2026-13561?
To fix CVE-2026-13561, update the Edimax EW-7478APC to the latest firmware version that addresses this vulnerability.
What is the impact of CVE-2026-13561?
CVE-2026-13561 allows an attacker to perform OS command injection via a crafted POST request.
Is remote exploitation possible with CVE-2026-13561?
Yes, the vulnerability CVE-2026-13561 can be exploited remotely.
What component is affected by CVE-2026-13561?
CVE-2026-13561 affects the POST Request Handler, specifically the formiNICbasic function in the Edimax EW-7478APC.