An open redirect vulnerability (CVE-2026-96892) affects Edimax BR-6428nC firmware version 1.16. The issue is in the websRedirect function within the goform Handler component, where an attacker can manipulate the submit-url parameter to redirect users to arbitrary external URLs. This can be triggered remotely and impacts multiple endpoints on the device. Although the vendor was contacted early, no response or patch has been provided. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code has been published, but there are no known exploits in the wild at this time.

Successful exploitation allows an attacker to redirect users to arbitrary external websites, potentially facilitating phishing or social engineering attacks. However, the vulnerability does not grant direct access or control over the device. The impact is limited to redirecting users, which may lead to user deception but not direct compromise of the router.

No official fix or patch is currently available from the vendor. Users should exercise caution when interacting with URLs or interfaces on the affected device. Monitor vendor channels for any future advisories or patches. Since the vendor did not respond to disclosure, consider network-level controls to restrict access to the device's web interface from untrusted networks.