This vulnerability affects Edimax BR-6675nD version 1.12 in the formUSBStorage function within the POST request handler. By manipulating the sub_dir parameter, an attacker can perform command injection remotely. The issue allows execution of arbitrary commands on the device, potentially compromising its integrity and availability. The vendor was contacted but did not provide a response or patch. No official remediation or patch links are available, and the vulnerability is publicly disclosed with an exploit published. The CVSS 4.0 score of 5.3 reflects medium severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Successful exploitation of this vulnerability enables remote attackers to execute arbitrary commands on the affected Edimax BR-6675nD device. This can lead to unauthorized control over the device, potentially impacting device functionality and network security. The medium CVSS score reflects moderate impact due to the ability to execute commands remotely without user interaction, though some privileges are required.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should monitor the vendor's communications for any future updates or patches. In the meantime, restricting network access to the device's management interface and disabling USB storage functionality if not needed may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.