CVE-2026-12807 | Edimax BR-6478AC V2 1.23 POST Request /goform/setWAN pppUserName/pptpUserName/L2TPUserName command injection

A vulnerability was found in Edimax BR-6478AC V2 1.23 and classified as critical. This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler. The manipulation of the argument pppUserName/pptpUserName/L2TPUserName results in command injection.

This vulnerability is known as CVE-2026-12807. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.