Command Injection Vulnerability in Edimax AC1200 Dual-Band Gigabit Router
CVE-2025-28146

9.8CRITICAL

Key Information:

Vendor

Edimax

Status
AC1200 Wave 2 Dual-Band Gigabit Router
Vendor
CVE Published:
4 April 2025

What is CVE-2025-28146?

A command injection vulnerability has been identified in the Edimax AC1200 Wave 2 Dual-Band Gigabit Router model BR-6478AC V3, specifically in the fota_url parameter within the /boafrm/formLtefotaUpgradeQuectel interface. This flaw could allow an unauthenticated attacker to execute arbitrary commands, potentially leading to unauthorized access and control over the device, thus compromising network security.

References

https://github.com/regainer27/edimax-br-6478ac_v3-br-6478...
https://gist.github.com/regainer27/469a6f2b694a76c3b58249...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.