Edimax BR-6478AC v2.20 has two authenticated root command injections

Edimax BR-6478AC firmware v2.20 has two authenticated command injections to root; no CVE, patch, or confirmed attacks are named.

0day Rubbish Research Team disclosed two authenticated command-injection flaws in Edimax BR-6478AC firmware image BR6478AC_v2.20.bin, an AC1750 SOHO router from Edimax Technology Co., Ltd. of Taiwan. An authenticated POST to the formWlanMP manufacturing radio-calibration handler, still registered in production firmware, reaches system() with thirty raw request fields interpolated into one command line. A separate authenticated POST to the setWAN WAN-configuration handler places a request-controlled username unquoted in a shell command; the disclosure says the sanitizer inspects exactly one character. Both issues are rated 7.2 with execution as root. No CVE, patch, or confirmed attacks are named. Exploit-DB lists a remote exploit for authenticated command injection in the same firmware.