This vulnerability allows an attacker to perform command injection by sending a specially crafted POST request to the /goform/formiNICbasic endpoint on Edimax BR-6478AC devices running firmware 1.23. The rootAPmac parameter is not properly sanitized, enabling remote code execution. The vendor has not provided a fix or mitigation, and the exploit code has been publicly released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary commands on the affected device, potentially compromising the router's operation and security. The medium CVSS score reflects limited impact due to low confidentiality, integrity, and availability impact metrics, but the ability to execute commands remotely still poses a significant risk to device integrity.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should consider disabling remote management features if possible, isolate the device from untrusted networks, or replace the device with a secure alternative. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.