The Edimax BR-6428NS router version 1.10 contains a command injection vulnerability in the formStaDrvSetup function of the POST request handler. By manipulating the stadrv_ssid parameter, an attacker can inject arbitrary commands remotely. This vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not provided any response or patch, and no official remediation guidance is available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's integrity and confidentiality. Given the medium CVSS score and the nature of command injection, attackers could leverage this vulnerability to gain control over the device or disrupt its operation. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider mitigating exposure by restricting remote access to the device's management interface and monitoring for suspicious activity. Applying network-level controls to limit access to the affected device may reduce risk until an official fix is released.