This vulnerability in Edimax BR-6478AC V2 version 1.23 allows remote command injection via the 'interface' parameter in the /goform/stainfo POST request handler. An attacker can remotely manipulate this argument to execute arbitrary commands on the device. The vendor has not provided a fix or response, and no official remediation is currently available. The vulnerability is publicly disclosed, but there are no known exploits in the wild at this time.

Successful exploitation could allow an attacker with network access to the device to execute arbitrary commands with limited privileges, potentially leading to unauthorized control or disruption of the device's operation. The impact is limited by the requirement for network access and the privilege level needed to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official Edimax channels for updates. Until a patch is available, restricting network access to the device and disabling remote management features may reduce exposure.