CVE-2026-9400 MEDIUM

CVE-2026-9400: Edimax BR-6675nD POST Request formUSBStorage command injection

Vendor Edimax
Product BR-6675nD
Weakness CWE-77
Published May 24, 2026
Last update May 27, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in Edimax BR-6675nD 1.12. This issue affects the function formUSBStorage of the file /goform/formUSBStorage of the component POST Request Handler. Executing a manipulation of the argument sub_dir can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

May 24, 2026 CVE published
May 27, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10959 Wavlink NU516U1 firewall.cgi sub_401778 command injection CVE-2026-3065 HummerRisk Cloud Task Dry-run CloudTaskService.java CommandUtils.commonExecCmdWithResult command injection CVE-2025-14106 ZSPACE Q2C NAS HTTP POST Request close zfilev2_api.CloseSafe command injection CVE-2025-14225 D-Link DCS-930L alphapd setSystemAdmin command injection CVE-2026-7628 crazyrabbitLTC mcp-code-review-server RepoMix repomix.ts executeRepomix command injection