This vulnerability affects Edimax BR-6478AC V2 version 1.23 in the POST request handler function wiz_5in1_redirect. An attacker can manipulate the 'newpass' parameter to inject arbitrary commands, leading to remote command execution. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). The vendor has not provided a fix or advisory, and no patch links are available. Exploit code is publicly available, but no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary commands on the affected device remotely, potentially compromising the device's integrity and confidentiality. This could lead to unauthorized control over the router and associated network traffic. The medium CVSS score reflects the network attack vector and low attack complexity but limited scope and impact.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the device's management interface from untrusted networks to reduce exposure. Review network segmentation and access controls to limit potential exploitation.