CVE-2026-9440: Edimax BR-6478AC POST Request formAccept command injection
A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formAccept of the file /goform/formAccept of the component POST Request Handler. Such manipulation of the argument submit-url leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9440?
The severity of CVE-2026-9440 is rated as medium with a score of 6.3.
What is the impact of CVE-2026-9440?
CVE-2026-9440 allows for command injection through the function formAccept in the Edimax BR-6478AC.
How do I fix CVE-2026-9440?
To fix CVE-2026-9440, you should update the Edimax BR-6478AC firmware to the latest version provided by the vendor.
Which component is affected by CVE-2026-9440?
CVE-2026-9440 affects the POST Request Handler component of the Edimax BR-6478AC router.
Can CVE-2026-9440 be exploited remotely?
Yes, CVE-2026-9440 can be exploited remotely due to its nature of command injection via POST requests.