CVE-2026-12810

Name of the Vulnerable Software and Affected Versions Edimax BR-6478AC V2 version 1.23

Description A security flaw in the POST Request Handler component allows for remote command injection. This occurs through the manipulation of the command argument within the mp() function of the '/goform/mp' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/goform/mp' endpoint to minimize the risk of exploitation.