CVE-2026-82703: OS Command Injection in Edimax BR-6214K

This vulnerability affects Edimax BR-6214K version 1.40 in the system function of the www/ping.asp file's asp_setPing endpoint. By manipulating the pingstr parameter, an attacker can perform OS command injection remotely, potentially executing arbitrary commands on the device. The exploit has been publicly released. No official remediation or patch has been provided by the vendor, and the vulnerability remains unmitigated.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the router. This could impact device availability, confidentiality, and integrity. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited scope and impact.

No official patch or remediation is currently available from the vendor. Users should consider disabling or restricting access to the vulnerable endpoint if possible, or isolate the device from untrusted networks to reduce exposure. Monitor vendor channels for any future updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.