This vulnerability exists in the Edimax BR-6675nD device firmware version 1.12, specifically in the formWlanMP function of the /goform/formWlanMP POST request handler. An attacker can manipulate multiple parameters (such as ateFunc, ateGain, ateRate, and others) to inject arbitrary commands remotely. The vulnerability allows remote attackers to execute commands on the device without user interaction and with low attack complexity. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to medium impact on confidentiality, integrity, and availability. No official fix or patch has been published by the vendor, and the vendor did not respond to the vulnerability disclosure.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and availability. Given the medium CVSS score and the nature of command injection, attackers could manipulate device behavior or disrupt network operations. However, no known exploits are currently observed in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor did not respond to the disclosure and no fixes have been published, users should consider mitigating exposure by restricting network access to the device's management interface, disabling remote management if possible, or replacing the device with a secure alternative. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.