CVE-2026-9439: Edimax BR-6675nD stainfo command injection
A vulnerability was determined in Edimax BR-6675nD 1.12. Affected is the function stainfo of the file /goform/stainfo. This manipulation of the argument interface causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax BR-6675nD 1.12from your environment.Disconnect, decommission, or replace the device if it is not required or until a vendor-provided fix is available.
- Configuration
Disable remote web management/administration on the device to prevent remote attackers from reaching the /goform/stainfo endpoint.
Edimax BR-6675nD web management remote_management = disabled - Compensating control
Block inbound access to the device and the /goform/stainfo endpoint at the network perimeter (firewall/router). Restrict management access to trusted IPs, management VLANs, or a VPN and remove the device from Internet exposure.
- Operational
If compromise is suspected, immediately isolate the device from the network, preserve logs for investigation, perform a factory reset or reflash known-good firmware if available, and monitor network traffic for signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9439?
CVE-2026-9439 has a severity rating of medium with a score of 6.3.
What type of vulnerability is associated with CVE-2026-9439?
CVE-2026-9439 is a command injection vulnerability.
How do I fix CVE-2026-9439?
To mitigate CVE-2026-9439, users should update the Edimax BR-6675nD router firmware to the latest available version.
Can CVE-2026-9439 be exploited remotely?
Yes, CVE-2026-9439 can be exploited remotely due to the nature of the command injection vulnerability.
What functionality is vulnerable in CVE-2026-9439?
The vulnerability in CVE-2026-9439 affects the 'stainfo' function in the '/goform/stainfo' file.