CVE-2026-82702: OS Command Injection in Edimax BR-6214K

This vulnerability affects Edimax BR-6214K version 1.40 specifically in the system function of the www/wlanMP.asp file of the asp_WlanMP Endpoint component. By manipulating the ateFunc argument, an attacker can perform OS command injection remotely, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. The vendor was contacted but did not provide any response or patch information. Public exploit code exists, increasing the risk of exploitation despite no current reports of active attacks.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact is limited to version 1.40 of the Edimax BR-6214K device. No known active exploitation has been reported, but public exploit availability increases risk.

No official fix or patch is currently available from the vendor. Since the vendor has not responded to disclosure and no remediation guidance exists, users should consider mitigating exposure by restricting remote access to the affected device, disabling vulnerable functionality if possible, or replacing the device. Monitor vendor channels for any future advisories or patches.