CVE-2026-9297: Edimax BR-6428NS POST Request formWlbasic command injection
A security vulnerability has been detected in Edimax BR-6428NS 1.10. Affected is the function formWlbasic of the file /goform/formWlbasic of the component POST Request Handler. The manipulation of the argument repeaterSSID leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax BR-6428NS 1.10from your environment.If the device cannot be adequately isolated or mitigated, remove or replace the affected device from the network until a vendor fix is available.
- Configuration
Disable remote/remote-web administration on the Edimax BR-6428NS so the POST handler (/goform/formWlbasic) is not reachable from untrusted networks.
Edimax BR-6428NS web administration remote management / remote administration = disabled - Compensating control
Prevent remote exploitation by blocking/inspecting HTTP(S) access to the device management interface. At the network perimeter or WAF, block POST requests to /goform/formWlbasic and/or requests containing the repeaterSSID parameter. Restrict access to the router's management interface to trusted IPs only.
- Operational
Assume exposure where the device was reachable from untrusted networks: audit logs and network traffic for exploitation attempts, isolate any suspected compromised devices, and perform incident-response actions (e.g., rebuild/replace affected device and change administrative credentials).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9297?
The severity of CVE-2026-9297 is rated as medium with a score of 6.3.
How do I fix CVE-2026-9297?
To mitigate CVE-2026-9297, consider updating the firmware of the Edimax BR-6428NS to the latest version provided by the manufacturer.
What type of vulnerability is associated with CVE-2026-9297?
CVE-2026-9297 is classified as a command injection vulnerability affecting the Edimax BR-6428NS device.
Can CVE-2026-9297 be exploited remotely?
Yes, CVE-2026-9297 can be exploited remotely due to its nature of being attacked through the web interface.
What component of the Edimax BR-6428NS is affected by CVE-2026-9297?
CVE-2026-9297 affects the POST Request Handler function formWlbasic of the file /goform/formWlbasic.