Executive brief
The Edimax BR-6214K router's web management interface contains a command injection flaw in its ping utility function. An authenticated attacker can manipulate the ping parameter to execute arbitrary system commands with root privileges, potentially compromising the router's integrity and enabling lateral attacks on the network it protects. This vulnerability requires valid admin credentials but could allow complete device takeover once authenticated.
Technical details
A CWE-78 OS command injection vulnerability exists in the asp_setPing endpoint of Edimax BR-6214K firmware 1.40. The pingstr parameter submitted to /goform/asp_setPing is passed directly into a system() call without proper sanitization or escaping of shell metacharacters. The attack requires valid web-management (admin) credentials and network access to the router's management interface. An authenticated attacker can inject shell commands (e.g., ;id;#) that are executed with the privileges of the Boa web server, which runs as root. The vulnerability has been publicly disclosed with proof-of-concept code available, and the vendor has not responded to early disclosure requests.
Affected products
- Edimax BR-6214K 1.40
Timeline
- 2026-08-31: disclosed
- exploited: Proof-of-concept code publicly available