This vulnerability affects Edimax BR-6478AC V2 version 1.23. The setWAN function in the /goform/setWAN endpoint improperly handles input parameters pppUserName, pptpUserName, and L2TPUserName, allowing an attacker to inject arbitrary commands. The vulnerability is remotely exploitable without user interaction and has been publicly disclosed. The vendor has not provided any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's functionality and security. The impact on confidentiality, integrity, and availability is assessed as low to limited based on the CVSS vector. No known exploits in the wild have been reported.

No official patch or remediation has been provided by the vendor. Since the vendor has not responded and no fixes are available, users should consider mitigating exposure by restricting network access to the affected device's management interface, disabling remote management if enabled, or replacing the device with a secure alternative. Monitor vendor channels for any future updates or patches.