This vulnerability affects Edimax BR-6228NC version 1.22 and involves command injection via the 'command' parameter in the POST request handler at /goform/mp. An attacker with network access can remotely send crafted requests to execute arbitrary commands on the device. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor has not provided a fix or advisory, and no patch links are available. The vulnerability is publicly disclosed with exploit code accessible, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and availability. The impact is rated medium due to the ability to execute commands remotely without user interaction or privileges, but with limited impact on confidentiality and integrity as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor. Users should monitor vendor channels for updates. Until a fix is released, restricting network access to the device's management interface and disabling remote administration features, if possible, may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.