This vulnerability affects Edimax BR-6478AC firmware version 1.23. The issue is located in the formiNICbasic function within the POST request handler at /goform/formiNICbasic. By manipulating the rootAPmac argument, an attacker can perform command injection remotely. The vulnerability has been assigned CVE-2026-9441 with a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not issued any advisory or patch, and the exploit code is publicly available. No cloud service is involved, and the device is locally managed hardware.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected device with limited privileges. This can lead to unauthorized control or disruption of the router's operation. The medium CVSS score reflects the moderate attack complexity and limited privileges required. No known exploits in the wild have been reported yet, but public exploit availability increases risk.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or provided a fix, users should consider mitigating exposure by restricting remote access to the device's management interface, disabling remote administration if possible, or replacing the device with a secure alternative. Monitor vendor channels for any future advisories or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.