This vulnerability affects Edimax BR-6478AC V2 version 1.23. The issue lies in the POST request handler component, specifically the 'mp' function at the /goform/mp endpoint. An attacker can remotely manipulate the 'command' argument to inject arbitrary commands, potentially leading to unauthorized command execution on the device. The vulnerability has been publicly disclosed with exploit code available. The vendor was contacted but has not provided any response or patch. No official remediation or fix has been documented at this time.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the affected device. This could lead to compromise of the router, unauthorized access to network resources, and potential further attacks within the network environment. The CVSS score of 5.3 reflects a medium severity impact with network attack vector, low complexity, and no user interaction required.

No official patch or remediation is currently available from the vendor. Users of Edimax BR-6478AC V2 version 1.23 should consider disabling remote management features if possible or isolating the device from untrusted networks to reduce exposure. Monitor vendor channels for any future security advisories or patches addressing this issue. Since the vendor has not responded, caution and network-level protections are advised.