CVE-2026-7683
MediumCVSS 6.3Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
In the Edimax BR-6428nC router up to version 1.16, manipulation of the pppUserName/pptpUserName argument in the /goform/setWAN file of the web interface leads to command injection. The attack can be initiated remotely, and a public exploit is available that could be used in attacks. The vendor was contacted early but did not respond.
Risk Assessment
A remote attacker could execute arbitrary commands on the device, potentially leading to full compromise of the router and network traffic. Since the exploit is publicly available, the risk of exploitation is high.
Recommendation
Restrict access to the router's web interface to trusted networks and consider replacing the device, as the vendor has not provided a fix. Monitor network traffic for unusual commands directed at the device.
Other vulnerabilities in Edimax BR-6428nC
See all- CVE-2026-100745Medium
A vulnerability in the Edimax BR-6428nC router version 1.16 affects an unknown function in the file /goform/formWizSurvey of the Wireless Wizard Handler component. Manipulation of the interface1/interface2 arguments leads to a stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-96892Medium
A flaw in Edimax BR-6428nC 1.16. The websRedirect function of the goform Handler improperly handles the submit-url argument, leading to open redirect. The attack can be launched remotely. The exploit has been published.
- CVE-2026-7684High
A vulnerability has been detected in Edimax BR-6428nC up to version 1.16, affecting an unknown function of the file /goform/setWAN. Manipulation of the argument pptpDfGateway leads to buffer overflow.
Original NVD description (English source)
A weakness has been identified in Edimax BR-6428nC up to 1.16. This affects an unknown function of the file /goform/setWAN of the component Web Interface. This manipulation of the argument pppUserName/pptpUserName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS