CVE-2026-9402: Edimax BR-6675nD POST Request formWlanMP command injection
A vulnerability was found in Edimax BR-6675nD 1.12. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component POST Request Handler. The manipulation of the argument ateFunc/ateGain/ateRate/ateChan/ateTxCount/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/ateTxFreqOffset/ateMode/ateMacID/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/readE2P/e2pTxPwDeltaN results in command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/Internet-accessible web management or remote administration on the device to prevent external POST requests (such as to /goform/formWlanMP).
Edimax BR-6675nD web management remote_management = disabled - Compensating control
At the network perimeter (firewall, router ACL, or WAF), restrict access to the device's management interface to a small set of trusted management IP addresses and block HTTP POST requests to the /goform/formWlanMP endpoint.
- Compensating control
If the device must remain online and cannot be patched, isolate it from untrusted networks (remove from Internet-facing segments or place behind management-only network) until a vendor fix is available.
- Operational
Monitor device logs for anomalous requests to /goform/formWlanMP and indicators of compromise. If compromise is suspected, perform device remediation (factory reset or re-image) and replace the device if necessary.
- Operational
Apply any vendor-supplied firmware/security update for the Edimax BR-6675nD as soon as Edimax releases a fix for the /goform/formWlanMP command injection vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9402?
CVE-2026-9402 has a medium severity score of 6.3.
What type of vulnerability is CVE-2026-9402?
CVE-2026-9402 is classified as a command injection vulnerability.
How do I fix CVE-2026-9402?
To fix CVE-2026-9402, update the Edimax BR-6675nD firmware to the latest version.
What should I do if I am using Edimax BR-6675nD with CVE-2026-9402?
If using Edimax BR-6675nD, it is advisable to apply the necessary firmware patches to mitigate CVE-2026-9402.
What components are affected by CVE-2026-9402?
CVE-2026-9402 affects the POST Request Handler, particularly the function formWlanMP.