This vulnerability affects Edimax BR-6675nD firmware version 1.12. It arises from insufficient input validation in the POST request handler function mp at the /goform/mp endpoint. By manipulating the 'command' parameter, an attacker with network access can perform command injection, potentially executing arbitrary commands on the device. The vulnerability is remotely exploitable without user interaction and requires high privileges. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required for attack initiation, and partial impact on confidentiality, integrity, and availability. The vendor has not issued any patch or official fix, and the exploit code is publicly available.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and availability. The impact is rated medium severity with partial impact on confidentiality, integrity, and availability. No known exploitation in the wild has been reported to date.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is provided, users should consider mitigating exposure by restricting network access to the device, disabling remote management if enabled, or replacing the device with a more secure alternative. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.