PT-2026-36687

CVE-2026-7683

Published

2026-05-03

Updated

2026-05-03

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC versions prior to 1.17

Description A command injection flaw exists in the Web Interface component. A remote attacker can exploit this by manipulating the pppUserName or pptpUserName arguments within the '/goform/setWAN' endpoint. Command injection is a type of attack where an attacker executes arbitrary operating system commands on the target server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Tian

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers