This vulnerability affects Edimax BR-6478AC version 1.23. The POST request handler function formWlbasic in the /goform/formWlbasic endpoint improperly processes the rootAPmac parameter, enabling an attacker to inject arbitrary commands remotely. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and low privileges. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. No vendor patch or official remediation level is currently documented.

Successful exploitation allows an attacker to execute arbitrary commands on the affected device remotely, potentially compromising the device's integrity and availability. The CVSS score of 5.3 reflects a medium severity impact with limited confidentiality, integrity, and availability impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting network exposure of the affected device and monitor for unusual activity. No official vendor mitigation or temporary fix has been documented.