CVE-2024-48418

Published: Jan 27, 2025Modified: Jul 5, 2026

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands.

Affected (1)

Products: Edimax: Br 6476ac Firmware

1 product

Br 6476ac Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Edimax Br 6476ac Firmware	Version 1.06

Running on/with	Platform Versions
Edimax Br 6476ac	All versions

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (1)

https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48418.md

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.