This vulnerability affects Edimax BR-6428NS firmware version 1.10. The issue is a command injection in the formWlbasic function, specifically via the repeaterSSID parameter in the POST request handler at /goform/formWlbasic. An attacker can remotely exploit this flaw to inject and execute arbitrary commands on the device. The vendor was notified but has not provided any fix or advisory. No official remediation or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the router’s operation. The medium CVSS score reflects the ease of remote exploitation with low attack complexity and no user interaction required, but limited scope and impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting access to the device’s management interface from untrusted networks and monitoring for unusual activity. Avoid using the vulnerable firmware version if possible until an official fix is available.