Is CVE-2026-9400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9400 being exploited in the wild.

How severe is CVE-2026-9400?

Medium severity, with a CVSS score of 6.3, published 24 May 2026.

Is there a fix for CVE-2026-9400?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9400 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9400?

Check whether you run Edimax BR-6675nD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9400: Edimax BR-6675nD command injection in formUSBStorage

CVE-2026-9400 · Severity: medium · CVSS 6.3 · Published 2026-05-24

A security vulnerability exists in the Edimax BR-6675nD wireless router, a device used to provide internet connectivity and network management. An attacker can remotely execute unauthorized commands on the router, potentially leading to a complete takeover of the device, interception of network traffic, or disruption of internet services. This issue is particularly concerning as an exploit has been publicly released and the manufacturer has not yet provided a fix.

Technologies: Edimax BR-6675nD. Vendors: Edimax.

Quick answers

Is CVE-2026-9400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9400 being exploited in the wild.
How severe is CVE-2026-9400?: Medium severity, with a CVSS score of 6.3, published 24 May 2026.
Which products and versions are affected?: Edimax BR-6675nD 1.12.
Is there a fix for CVE-2026-9400?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9400 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9400?: Check whether you run Edimax BR-6675nD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the Edimax BR-6675nD router version 1.12 within the POST request handler. The flaw is located in the 'formUSBStorage' function of the '/goform/formUSBStorage' endpoint. By manipulating the 'sub_dir' argument in a POST request, a remote attacker with low privileges can inject and execute arbitrary system commands on the underlying operating system. The vulnerability is reachable over the network, and while it requires authentication (PR:L), public exploit code is available. As of the advisory date, the vendor has not responded to disclosure attempts, and no patch is currently available.

Affected products

Edimax BR-6675nD 1.12

Timeline

2026-05-24: advisory: Initial disclosure by VulDB and NVD
2026-05-24: disclosed: Exploit published publicly

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.