This vulnerability affects the Edimax BR-6428nC router firmware versions 1.0 through 1.16. It involves a command injection flaw in the web interface's /goform/setWAN function, triggered by crafted input in the pppUserName or pptpUserName parameters. Successful exploitation allows an attacker to execute arbitrary commands remotely on the device. The vulnerability has been publicly disclosed, but no vendor response or patch has been provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

An attacker can remotely execute arbitrary commands on affected Edimax BR-6428nC devices by exploiting the command injection vulnerability in the web interface. This could lead to unauthorized control or disruption of the device. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits in the wild have been reported at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users should monitor for any future vendor advisories or firmware updates addressing this issue. Until a fix is released, consider restricting remote access to the device's web interface and employing network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.