CVE-2026-9296: Edimax BR-6428NS POST Request formWlanM system command injection
A weakness has been identified in Edimax BR-6428NS 1.10. This impacts the function system of the file /goform/formWlanM of the component POST Request Handler. Executing a manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the device UI exposes an option to disable remote management or to disable handling of POST requests to /goform/formWlanM, disable it to prevent remote exploitation of the vulnerable handler.
Edimax BR-6428NS POST Request Handler (/goform/formWlanM) remote/POST access to /goform/formWlanM = disabled - Compensating control
Restrict network access to the device management interface to trusted IPs only (block WAN/untrusted networks). Enforce this at the perimeter firewall or router.
- Compensating control
Block or filter HTTP POST requests to the path /goform/formWlanM using a firewall, WAF, reverse proxy, or access control list to prevent exploitation of the vulnerable parameters.
- Operational
Monitor device logs, web server access logs, and IDS/IPS alerts for requests to /goform/formWlanM and for signs of command-injection attempts; deploy detection signatures or rules to alert on exploitation attempts.
- Operational
Contact the vendor to request firmware updates or mitigations and apply any vendor-supplied patches or firmware as soon as they become available; check vendor advisories regularly.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9296?
The severity of CVE-2026-9296 is rated as medium with a score of 6.3.
How do I fix CVE-2026-9296?
To fix CVE-2026-9296, update the Edimax BR-6428NS firmware to the latest version provided by the manufacturer.
What systems are affected by CVE-2026-9296?
CVE-2026-9296 affects the Edimax BR-6428NS version 1.10 router.
What type of vulnerability is CVE-2026-9296?
CVE-2026-9296 is classified as a command injection vulnerability.
What are the potential impacts of CVE-2026-9296?
Exploitation of CVE-2026-9296 can lead to unauthorized system command execution on the affected device.