Edimax BR-6478AC v2.20 setWAN handler has authenticated command injection
Original title: [0day-rubbish] Edimax BR-6478AC firmware v2.20 authenticated command injection in the setWAN WAN-configuration handler, root command execution (7.2)
A WAN-settings POST passes an unsanitized username into system(), and the check looks at one character.
0day Rubbish Research Team disclosed an authenticated command injection in Edimax BR-6478AC firmware image BR6478AC_v2.20.bin. The dual-band AC1750 SOHO router is made by Edimax Technology Co., Ltd. of Taiwan. An authenticated POST to the setWAN WAN-configuration handler reaches system() with a request-controlled username placed unquoted in a shell command. The snippet names no patch.
Unconfirmed: The snippet is truncated and does not confirm a CVE, patch, or exploitation in the wild.
- The disclosure title rates the issue 7.2 and says execution is as root.
- The sanitiser inspects exactly one character, the disclosure says.
- The vulnerable request resembles an ordinary WAN settings submission.
- No CVE is named in the snippet.
Impact: authenticated root command execution
| Product | Affected |
|---|---|
| Edimax Technology BR-6478AC | firmware v2.20 (BR6478AC_v2.20.bin) |
- Vendors
- Edimax Technology
- Products
- BR-6478AC
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the Edimax BR-6478AC, firmware image BR6478AC_v2. 20. bin, the dual-band AC1750 SOHO wireless router from Edimax Technology Co.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.