This vulnerability affects Edimax BR-6208AC firmware version 1.02. It arises from improper input validation in the setWAN function handling the L2TPUserName parameter within the L2TP Mode component. An attacker can remotely supply crafted input to this parameter, resulting in command injection on the device. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The vendor has not provided a fix or advisory, and no patch links are available. Public exploit code exists, increasing the risk of potential attacks.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device with the privileges of the vulnerable service. This can lead to unauthorized control over the router, potentially compromising network security and device integrity. The medium CVSS score reflects limited impact or complexity factors but does not diminish the risk posed by command injection vulnerabilities. No known active exploitation has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the vulnerability disclosure. Users should consider disabling L2TP Mode if possible or restricting remote access to the device management interface to trusted networks only. Monitor for updates from Edimax for any future patches or advisories. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.