Medium severity · published May 25, 2026
CVE-2026-9440
Edimax BR-6478AC POST Request formAccept command injection
6.3
CVSS
16.6%
EPSS
No
On KEV
Description
A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formAccept of the file /goform/formAccept of the component POST Request Handler. Such manipulation of the argument submit-url leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)16.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
BR-6478AC · Edimax
1.23 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9440
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9440
lavender-bicycle-a5a.notion.site
https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formAccept-34b53a41781f800093ccd3404dbc4461?source=copy_link
vuldb.com
https://vuldb.com/submit/818449
vuldb.com
https://vuldb.com/vuln/365421
vuldb.com
https://vuldb.com/vuln/365421/cti
More from BR-6478AC
9.8
CVE-2023-49351
A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located on the stack due to…
8.8
CVE-2026-10165
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
8.8
CVE-2026-10164
Edimax BR-6478AC POST Request formUSBFolder buffer overflow
8.8
CVE-2026-10163
Edimax BR-6478AC POST Request formUSBAccount buffer overflow
8.8
CVE-2026-10126
Edimax BR-6478AC POST Request formQoS buffer overflow