CVE-2026-8774: Edimax BR-6228NC POST Request mp command injection
A vulnerability was detected in Edimax BR-6228NC 1.22. Affected by this issue is the function mp of the file /goform/mp of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Block or disable HTTP POST requests to the /goform/mp endpoint on the device. If the device UI does not allow disabling this handler, configure an inline WAF or reverse proxy to block POST requests to /goform/mp.
Edimax BR-6228NC web interface POST /goform/mp = disabled/blocked - Compensating control
Restrict network access to the device management interface to trusted IPs only (management VLAN, firewall/ACLs). Ensure the device is not reachable from the WAN/internet and place it behind network segmentation to prevent remote access.
- Operational
Isolate any affected Edimax BR-6228NC devices from untrusted networks until mitigations are in place. Monitor device logs and network traffic for signs of exploitation (requests to /goform/mp or other suspicious activity). If compromise is suspected, perform forensic analysis, factory reset or replace the device, and restore from known-good configurations.
- Operational
Track vendor advisories for Edimax BR-6228NC and apply official firmware updates when a vendor fix is released. Reassess and remove compensating controls only after verifying the vendor-supplied fix mitigates the vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8774?
CVE-2026-8774 is classified as a high severity vulnerability due to its potential for command injection.
How do I fix CVE-2026-8774?
To fix CVE-2026-8774, it is recommended to upgrade the firmware of Edimax BR-6228NC to a version that addresses this vulnerability.
What are the consequences of exploiting CVE-2026-8774?
Exploiting CVE-2026-8774 may allow an attacker to execute arbitrary commands on the affected device.
Which versions are affected by CVE-2026-8774?
CVE-2026-8774 affects Edimax BR-6228NC version 1.22.
What component is vulnerable in CVE-2026-8774?
The vulnerability in CVE-2026-8774 is found in the POST Request Handler, specifically the function mp of the file /goform/mp.