CVE-2026-9379: Edimax BR-6675nD POST Request formWpsStart command injection
A weakness has been identified in Edimax BR-6675nD 1.12. This impacts the function formWpsStart of the file /goform/formWpsStart of the component POST Request Handler. This manipulation of the argument pinCode causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax BR-6675nDfrom your environment.Replace or decommission the affected device if a vendor patch or acceptable mitigations cannot be obtained or applied.
- Configuration
Disable WPS (Wi‑Fi Protected Setup) in the router administration interface to prevent use of the vulnerable /goform/formWpsStart endpoint.
Edimax BR-6675nD (WPS) WPS = disabled - Compensating control
Block inbound access from untrusted networks (WAN/Internet) to the router management interface and to the /goform/formWpsStart endpoint using firewall rules or router ACLs.
- Compensating control
If available, deploy a WAF or HTTP proxy rule to block or drop POST requests to /goform/formWpsStart or to filter/sanitize the pinCode parameter to prevent command injection.
- Operational
Monitor device logs and network traffic for signs of exploitation. If compromise is suspected, immediately isolate the device from networks, perform a factory reset or rebuild, and rotate any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9379?
The severity of CVE-2026-9379 is rated as medium with a score of 6.3.
What type of vulnerability is CVE-2026-9379?
CVE-2026-9379 is classified as a command injection vulnerability.
How do I fix CVE-2026-9379?
To fix CVE-2026-9379, update the Edimax BR-6675nD firmware to the latest version provided by the manufacturer.
Can CVE-2026-9379 be exploited remotely?
Yes, CVE-2026-9379 can be exploited remotely due to its nature as a command injection vulnerability.
What component of Edimax BR-6675nD is affected by CVE-2026-9379?
CVE-2026-9379 affects the POST Request Handler in the formWpsStart function.