CVE-2026-36734 describes a command injection vulnerability in EDIMAX BR-6428nS V3 version 1.15. The flaw exists due to insufficient input validation in the WLAN configuration interface, allowing an authenticated network attacker to submit crafted input that results in arbitrary system command execution on the device. This vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated attacker with network access to execute arbitrary system commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could enable unauthorized control, data theft, or disruption of device functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the device's management interface to trusted users only and monitor for suspicious activity. Avoid exposing the device's configuration interface to untrusted networks.