# CVE-2026-12808: Edimax BR-6478AC V2 command injection in stainfo POST handler

Source: https://junglewise.ai/threats/cve-2026-12808-edimax-br-6478ac-v2-command-injection-in-stainfo-post-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-21. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-12808 · Severity: medium · CVSS 6.3 · Published 2026-06-21

A security vulnerability has been identified in the Edimax BR-6478AC V2 wireless router. This device is commonly used to provide internet connectivity and manage local network traffic for homes and small offices. An attacker could exploit this flaw to take control of the router's operating system, potentially leading to unauthorized access to network traffic or a complete disruption of internet services.

Technologies: [Edimax BR-6478AC V2](https://junglewise.ai/threats/technologies/br-6478ac-v2). Vendors: [Edimax](https://junglewise.ai/threats/vendors/edimax).

## Quick answers

**Is CVE-2026-12808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12808 being exploited in the wild.

**How severe is CVE-2026-12808?** Medium severity, with a CVSS score of 6.3, published 21 June 2026.

**Which products and versions are affected?** Edimax BR-6478AC V2 1.23.

**Is there a fix for CVE-2026-12808?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12808 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12808?** Check whether you run Edimax BR-6478AC V2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the Edimax BR-6478AC V2 router running firmware version 1.23. The flaw is located within the 'stainfo' function of the '/goform/stainfo' component, which handles POST requests. By manipulating the 'interface' argument, a remote attacker with low privileges can inject and execute arbitrary system commands on the underlying operating system. The attack vector is network-based and does not require user interaction, though it may require basic authentication (PR:L). As of the advisory date, the vendor has not responded to disclosure attempts, and no official patch is currently available.

## Affected products

- Edimax BR-6478AC V2 1.23

## Timeline

- 2026-06-21: disclosed: Vulnerability disclosed and added to NVD/VulDB

## References

- [https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-stainfo-34b53a41781f80a38eabd3f33d5e939c?source=copy_link](https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-stainfo-34b53a41781f80a38eabd3f33d5e939c?source=copy_link)
- [https://vuldb.com/cve/CVE-2026-12808](https://vuldb.com/cve/CVE-2026-12808)
- [https://vuldb.com/submit/836672](https://vuldb.com/submit/836672)
- [https://vuldb.com/vuln/372602](https://vuldb.com/vuln/372602)
- [https://vuldb.com/vuln/372602/cti](https://vuldb.com/vuln/372602/cti)

## Related threats

- [Edimax BR-6478AC V2 command injection in POST Request Handler](https://junglewise.ai/threats/cve-2026-12810-edimax-br-6478ac-v2-command-injection-in-post-request-handler)
- [Edimax BR-6478AC V2 command injection in wiz_5in1_redirect](https://junglewise.ai/threats/cve-2026-12809-edimax-br-6478ac-v2-command-injection-in-wiz-5in1-redirect)
- [Edimax BR-6478AC V2 command injection in setWAN](https://junglewise.ai/threats/cve-2026-12807-edimax-br-6478ac-v2-command-injection-in-setwan)
- [Edimax BR-6478AC V2 buffer overflow in formWlSiteSurvey](https://junglewise.ai/threats/cve-2026-12806-edimax-br-6478ac-v2-buffer-overflow-in-formwlsitesurvey)