PT-2026-36687 · Edimax · Br-6428Nc

Tian · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7683

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC versions prior to 1.17

Description A command injection flaw exists in the Web Interface component. A remote attacker can exploit this by manipulating the pppUserName or pptpUserName arguments within the '/goform/setWAN' endpoint. Command injection is a type of attack where an attacker executes arbitrary operating system commands on the target server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-7683

Affected Products

Br-6428Nc

References · 11

• 🔥 https://tzh00203.notion.site/Edimax-BR-6428nC-v1-16-setWAN-pptpUserName-Command-Injection-33db5c52018a80949cfbcc2091340c80 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7683 · Security Note
• https://twitter.com/CVEnew/status/2050854477654049138 · Twitter Post
• https://vuldb.com/submit/801597 · Note
• https://tzh00203.notion.site/Edimax-BR-6428nC-v1-16-setWAN-pppUserName-Command-Injection-33db5c52018a80dab299ef508e810d00 · Note
• https://vuldb.com/vuln/360842/cti · Note
• https://twitter.com/infoflowcloud/status/2050855644257759514 · Twitter Post
• https://vuldb.com/submit/801598 · Note
• https://twitter.com/VulmonFeeds/status/2050842831019757866 · Twitter Post
• https://t.me/CVEtracker/52563 · Telegram Post
• https://vuldb.com/vuln/360842 · Note