CVE-2026-10127— Edimax BR-6478AC POST Request formStaDrvSetup command injection
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Edimax BR-6478AC POST Request formStaDrvSetup command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. This manipulation of the argument rootAPmac causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Edimax BR-6478AC 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Edimax BR-6478AC是中国讯舟（Edimax）公司的一款双频千兆路由器。 Edimax BR-6478AC 1.23版本存在命令注入漏洞，该漏洞源于组件POST Request Handler中文件/goform/formStaDrvSetup的函数formStaDrvSetup对参数rootAPmac的操作导致命令注入，攻击者可远程发起攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-10127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10127
请登录查看更多情报信息。
Proof of Concept for CVE-2026-10127 (1)
Same Patch Batch · Edimax · 2026-05-30 · 3 CVEs total
| CVE-2026-10126 | 8.8 HIGH | Edimax BR-6478AC POST Request formQoS buffer overflow |
| CVE-2026-10125 | 8.8 HIGH | Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow |
IV. Related Vulnerabilities
Same product: BR-6478AC
- CVE-2026-10166
Edimax BR-6478AC POST Request formWlbasic command injection - CVE-2026-10165
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based - CVE-2026-10164
Edimax BR-6478AC POST Request formUSBFolder buffer overflow - CVE-2026-10163
Edimax BR-6478AC POST Request formUSBAccount buffer overflow - CVE-2026-10126
Edimax BR-6478AC POST Request formQoS buffer overflow
Same vendor: Edimax
- CVE-2026-13583
Edimax EW-7478APC POST Request formUSBFolder buffer overflow - CVE-2026-13582
Edimax EW-7478APC POST Request formUSBAccount buffer overflo - CVE-2026-13581
Edimax EW-7478APC POST Request formStaDrvSetup os command in - CVE-2026-13580
Edimax EW-7478APC POST Request formQoS buffer overflow - CVE-2026-13564
Edimax EW-7478APC POST Request formPPPoESetup stack-based ov
Same weakness: CWE-77
- CVE-2026-15481
Trendnet TEW-635BRM IPoA WAN Connection Setup rc ipoa_test c - CVE-2025-6784
Code Engine <= 0.3.5 - Authenticated (Contributor+) Remote C - CVE-2026-59721
Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmai - CVE-2026-15035
bentoml OpenLLM Model Repository Directory Name common.py as - CVE-2026-9834
WP Database Backup <= 7.11 - Authenticated (Administrator+)
V. Comments for CVE-2026-10127
No comments yet