Edimax vulnerabilities, page 2
156 vulnerabilities
Known vulnerabilities in Edimax products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 35 products.
CVE-2025-56706edimaxbr-6473ax_firmware
EPSS score2.02%
Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function.CVE-2025-22906edimaxre11s_firmwareEPSS score2.26%
RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN.CVE-2025-22916edimaxre11s_firmwareEPSS score0.63%
RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function.CVE-2025-22905edimaxre11s_firmwareEPSS score4.58%
RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.CVE-2025-22907edimaxre11s_firmwareEPSS score0.63%
RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.CVE-2025-22912edimaxre11s_firmwareEPSS score1.93%
RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.CVE-2025-22913edimaxre11s_firmwareEPSS score0.78%
RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.CVE-2025-22904edimaxre11s_firmwareEPSS score0.63%
RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function.CVE-2025-22911edimaxre11s_firmwareEPSS score0.36%
RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function.CVE-2025-45857edimaxcv-7428ns_firmwareEPSS score1.08%
EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function.CVE-2025-70161edimaxbr-6208acEPSS score27.06%
EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.CVE-2025-28145edimaxbr-6478ac_v3_firmwareEPSS score9.82%
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat.CVE-2025-28146edimaxbr-6478ac_v3_firmwareEPSS score11.48%
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectelCVE-2025-28143edimaxbr-6478ac_v3_firmwareEPSS score9.47%
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup.CVE-2025-28144edimaxbr-6478ac_v3_firmwareEPSS score5.13%
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function.CVE-2025-28142edimaxbr-6478ac_v3_firmwareEPSS score9.82%
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare.CVE-2025-15257edimaxbr-6208acEPSS score5.08%
A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.CVE-2025-15256edimaxbr-6208acEPSS score3.76%
A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.CVE-2025-15258edimaxbr-6208acEPSS score0.26%
A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the component Web-based Configuration Interface. This manipulation of the argument wlan-url causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.CVE-2025-34024edimaxedimax ew-7438rpn mini+1EPSS score3.81%
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.