Edimax BR-6478AC v2.20 formWlanMP handler has authenticated command injection
Original title: [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the formWlanMP manufacturing-test handler, root command execution (7.2)
A production manufacturing-test route still accepts thirty raw fields that are passed to system().
0day Rubbish Research Team disclosed a second authenticated command injection in Edimax BR-6478AC firmware BR6478AC_v2.20.bin. The flaw is in the formWlanMP manufacturing radio-calibration handler, which remains registered in production firmware. An authenticated POST reaches system() with thirty raw request fields interpolated into one command line. The snippet does not state a fix or CVE.
Unconfirmed: The snippet is truncated and does not confirm a CVE, patch, or real-world exploitation.
- The disclosure title rates this issue 7.2 and says execution is as root.
- The route is a manufacturing radio-calibration handler.
- Edimax Technology Co., Ltd. of Taiwan makes the AC1750 SOHO router.
- The snippet cuts off before describing the web server process.
Impact: authenticated root command execution
| Product | Affected |
|---|---|
| Edimax Technology BR-6478AC | firmware v2.20 (BR6478AC_v2.20.bin) |
- Vendors
- Edimax Technology
- Products
- BR-6478AC
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax BR-6478AC, firmware image BR6478AC_v2. 20. bin, the dual-band AC1750 SOHO wireless router from Edimax Technology Co.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.