This vulnerability affects Edimax BR-6478AC firmware version 1.23. The formAccept function in the POST request handler improperly handles the submit-url argument, enabling an attacker to inject arbitrary commands remotely. The vulnerability is confirmed and publicly disclosed with an available exploit. No vendor response or patch has been provided, and the device is not a cloud service, so remediation depends on vendor action or user mitigation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising the router's integrity and control. Given the medium CVSS score of 5.3, the impact is significant but not critical. There is no indication of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure. Users should monitor for vendor advisories for any future fixes. Until a patch is released, affected devices should be isolated from untrusted networks or replaced. Network-level controls such as firewall rules restricting access to the device's management interface may reduce exposure.