https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32842.htmlhttps://patchthecve.com/cve/CVE-2026-32842.htmlWed, 17 Jun 2026 10:36:25 +0000MEDIUM 6.5: Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credentials by accessing configuration backup files. Attackers can download the config.bin file through fupload.cgi to extract plaintext username andhttps://patchthecve.com/cve/CVE-2026-32841.htmlhttps://patchthecve.com/cve/CVE-2026-32841.htmlWed, 17 Jun 2026 10:36:25 +0000HIGH 8.1: Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows unauthenticated attackers to access the management interface. Attackers can exploit the global authentication flag mechanism to gain administrative access without credentials after any usehttps://patchthecve.com/cve/CVE-2026-32840.htmlhttps://patchthecve.com/cve/CVE-2026-32840.htmlWed, 17 Jun 2026 10:36:25 +0000MEDIUM 5.4: Edimax GS-5008PL firmware version 1.00.54 and prior contain a stored cross-site scripting vulnerability in the system_name_set.cgi script that allows attackers to inject arbitrary script code by manipulating the sysName parameter. Attackers can send a crafted POST request with malicious script paylohttps://patchthecve.com/cve/CVE-2026-32839.htmlhttps://patchthecve.com/cve/CVE-2026-32839.htmlWed, 17 Jun 2026 10:36:25 +0000MEDIUM 4.3: Edimax GS-5008PL firmware version 1.00.54 and prior contain a cross-site request forgery vulnerability that allows remote attackers to perform unauthorized administrative actions by inducing logged-in administrators to visit malicious pages. Attackers can exploit the lack of anti-CSRF tokens and reqhttps://patchthecve.com/cve/CVE-2026-32838.htmlhttps://patchthecve.com/cve/CVE-2026-32838.htmlWed, 17 Jun 2026 10:36:25 +0000HIGH 7.5: Edimax GS-5008PL firmware version 1.00.54 and prior use cleartext HTTP for the web management interface without implementing TLS or SSL encryption. Attackers on the same network can intercept management traffic to capture administrator credentials and sensitive configuration data.https://patchthecve.com/cve/CVE-2026-1972.htmlhttps://patchthecve.com/cve/CVE-2026-1972.htmlWed, 17 Jun 2026 10:16:48 +0000MEDIUM 5.3: A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated remotely. The exploit has been made public and could be usedhttps://patchthecve.com/cve/CVE-2026-1971.htmlhttps://patchthecve.com/cve/CVE-2026-1971.htmlWed, 17 Jun 2026 10:16:48 +0000LOW 2.4: A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation of the argument manualssid leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public https://patchthecve.com/cve/CVE-2026-1970.htmlhttps://patchthecve.com/cve/CVE-2026-1970.htmlWed, 17 Jun 2026 10:16:48 +0000LOW 3.5: A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of the argument submit-url causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The vendohttps://patchthecve.com/cve/CVE-2020-37150.htmlhttps://patchthecve.com/cve/CVE-2020-37150.htmlWed, 17 Jun 2026 03:17:07 +0000HIGH 7.5: Edimax EW-7438RPn-v3 Mini 1.27 allows unauthenticated attackers to access the /wizard_reboot.asp page in unsetup mode, which discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without authehttps://patchthecve.com/cve/CVE-2020-37149.htmlhttps://patchthecve.com/cve/CVE-2020-37149.htmlWed, 17 Jun 2026 03:17:06 +0000HIGH 8.1: Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the device with the user's privileghttps://patchthecve.com/cve/CVE-2020-37125.htmlhttps://patchthecve.com/cve/CVE-2020-37125.htmlWed, 17 Jun 2026 03:17:03 +0000CRITICAL 9.8: Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and https://patchthecve.com/cve/CVE-2020-37097.htmlhttps://patchthecve.com/cve/CVE-2020-37097.htmlWed, 17 Jun 2026 03:16:57 +0000HIGH 7.5: Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Attackers can access the script to retrieve sensitive information including WiFi network name and plaintext password stored in device configurathttps://patchthecve.com/cve/CVE-2020-37096.htmlhttps://patchthecve.com/cve/CVE-2020-37096.htmlWed, 17 Jun 2026 03:16:57 +0000MEDIUM 5.3: Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft malicious web pages to trick users into adding unauthorized MAC addresses to the device's filtering rules without their consent.https://patchthecve.com/cve/CVE-2025-70161.htmlhttps://patchthecve.com/cve/CVE-2025-70161.htmlWed, 17 Jun 2026 10:03:10 +0000CRITICAL 9.8: EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrhttps://patchthecve.com/cve/CVE-2025-15258.htmlhttps://patchthecve.com/cve/CVE-2025-15258.htmlWed, 17 Jun 2026 08:37:28 +0000LOW 3.5: A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the component Web-based Configuration Interface. This manipulation of the argument wlan-url causes open redirect. The attack is possible to be carriedhttps://patchthecve.com/cve/CVE-2025-15257.htmlhttps://patchthecve.com/cve/CVE-2025-15257.htmlWed, 17 Jun 2026 08:37:28 +0000HIGH 7.3: A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The athttps://patchthecve.com/cve/CVE-2025-15256.htmlhttps://patchthecve.com/cve/CVE-2025-15256.htmlWed, 17 Jun 2026 08:37:28 +0000HIGH 7.3: A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack is phttps://patchthecve.com/cve/CVE-2025-14910.htmlhttps://patchthecve.com/cve/CVE-2025-14910.htmlWed, 17 Jun 2026 08:36:45 +0000MEDIUM 4.3: A vulnerability was detected in Edimax BR-6208AC 1.02. This impacts the function handle_retr of the component FTP Daemon Service. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. Edimax confirms this issue: "This product is nhttps://patchthecve.com/cve/CVE-2025-14094.htmlhttps://patchthecve.com/cve/CVE-2025-14094.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 4.7: A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has been published and may be used. The vendor https://patchthecve.com/cve/CVE-2025-14093.htmlhttps://patchthecve.com/cve/CVE-2025-14093.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 4.7: A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnosticRun. The manipulation of the argument host results in os command injection. The attack can be launched remotely. The exploit is now public and may be used. The https://patchthecve.com/cve/CVE-2025-14092.htmlhttps://patchthecve.com/cve/CVE-2025-14092.htmlSun, 18 Oct 2026 14:10:00 +0000MEDIUM 4.7: A security vulnerability has been detected in Edimax BR-6478AC V3 1.0.15. This issue affects the function sub_416898 of the file /boafrm/formDebugDiagnosticRun. The manipulation of the argument host leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed phttps://patchthecve.com/cve/CVE-2025-56706.htmlhttps://patchthecve.com/cve/CVE-2025-56706.htmlWed, 17 Jun 2026 09:42:44 +0000HIGH 8.0: Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function.https://patchthecve.com/cve/CVE-2025-34029.htmlhttps://patchthecve.com/cve/CVE-2025-34029.htmlWed, 17 Jun 2026 09:13:20 +0000HIGH 8.8: An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commhttps://patchthecve.com/cve/CVE-2025-34024.htmlhttps://patchthecve.com/cve/CVE-2025-34024.htmlWed, 17 Jun 2026 09:13:19 +0000HIGH 8.8: An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters thttps://patchthecve.com/cve/CVE-2025-45857.htmlhttps://patchthecve.com/cve/CVE-2025-45857.htmlWed, 17 Jun 2026 09:25:46 +0000CRITICAL 9.8: EDIMAX CV7428NS v1.20 was discovered to contain a remote code execution (RCE) vulnerability via the command parameter in the mp function.https://patchthecve.com/cve/CVE-2025-22911.htmlhttps://patchthecve.com/cve/CVE-2025-22911.htmlWed, 17 Jun 2026 08:50:55 +0000MEDIUM 5.6: RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formiNICbasicREP function.https://patchthecve.com/cve/CVE-2025-28145.htmlhttps://patchthecve.com/cve/CVE-2025-28145.htmlWed, 17 Jun 2026 09:04:36 +0000MEDIUM 6.5: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat.https://patchthecve.com/cve/CVE-2025-28144.htmlhttps://patchthecve.com/cve/CVE-2025-28144.htmlWed, 17 Jun 2026 09:04:36 +0000MEDIUM 6.5: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function.https://patchthecve.com/cve/CVE-2025-28143.htmlhttps://patchthecve.com/cve/CVE-2025-28143.htmlWed, 17 Jun 2026 09:04:36 +0000MEDIUM 6.5: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup.https://patchthecve.com/cve/CVE-2025-28142.htmlhttps://patchthecve.com/cve/CVE-2025-28142.htmlWed, 17 Jun 2026 09:04:36 +0000MEDIUM 6.5: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare.https://patchthecve.com/cve/CVE-2025-28146.htmlhttps://patchthecve.com/cve/CVE-2025-28146.htmlWed, 17 Jun 2026 09:04:36 +0000CRITICAL 9.8: Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectelhttps://patchthecve.com/cve/CVE-2025-1316.htmlhttps://patchthecve.com/cve/CVE-2025-1316.htmlWed, 17 Jun 2026 08:38:54 +0000CRITICAL 9.8: Edimax IC-7100 does not properly neutralize requests. An attacker can create specially crafted requests to achieve remote code execution on the devicehttps://patchthecve.com/cve/CVE-2025-1612.htmlhttps://patchthecve.com/cve/CVE-2025-1612.htmlWed, 17 Jun 2026 08:39:27 +0000LOW 3.5: A vulnerability was found in Edimax BR-6288ACL 1.30. It has been declared as problematic. This vulnerability affects unknown code of the file wireless5g_basic.asp. The manipulation of the argument SSID leads to cross site scripting. The attack can be initiated remotely. The vendor was contacted earlhttps://patchthecve.com/cve/CVE-2024-48420.htmlhttps://patchthecve.com/cve/CVE-2024-48420.htmlSun, 05 Jul 2026 01:20:46 +0000HIGH 8.8: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/getWifiBasic.https://patchthecve.com/cve/CVE-2024-48419.htmlhttps://patchthecve.com/cve/CVE-2024-48419.htmlSun, 05 Jul 2026 01:20:45 +0000HIGH 8.8: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to thttps://patchthecve.com/cve/CVE-2024-48418.htmlhttps://patchthecve.com/cve/CVE-2024-48418.htmlSun, 05 Jul 2026 01:20:45 +0000HIGH 8.8: In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands.https://patchthecve.com/cve/CVE-2024-48417.htmlhttps://patchthecve.com/cve/CVE-2024-48417.htmlSun, 05 Jul 2026 01:20:44 +0000MEDIUM 5.2: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Cross Site Scripting (XSS) in : /bin/goahead via /goform/setStaticRoute, /goform/fromSetFilterUrlFilter, and /goform/fromSetFilterClientFilter.https://patchthecve.com/cve/CVE-2024-48416.htmlhttps://patchthecve.com/cve/CVE-2024-48416.htmlSun, 05 Jul 2026 01:20:44 +0000HIGH 8.8: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding.https://patchthecve.com/cve/CVE-2025-22916.htmlhttps://patchthecve.com/cve/CVE-2025-22916.htmlSun, 05 Jul 2026 01:21:23 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a stack overflow via the pppUserName parameter in the formPPPoESetup function.https://patchthecve.com/cve/CVE-2025-22913.htmlhttps://patchthecve.com/cve/CVE-2025-22913.htmlWed, 17 Jun 2026 08:50:56 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function.https://patchthecve.com/cve/CVE-2025-22912.htmlhttps://patchthecve.com/cve/CVE-2025-22912.htmlSun, 05 Jul 2026 01:21:23 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.https://patchthecve.com/cve/CVE-2025-22907.htmlhttps://patchthecve.com/cve/CVE-2025-22907.htmlSun, 05 Jul 2026 01:21:23 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a stack overflow via the selSSID parameter in the formWlSiteSurvey function.https://patchthecve.com/cve/CVE-2025-22906.htmlhttps://patchthecve.com/cve/CVE-2025-22906.htmlSun, 05 Jul 2026 01:21:22 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a command injection vulnerability via the L2TPUserName parameter at /goform/setWAN.https://patchthecve.com/cve/CVE-2025-22905.htmlhttps://patchthecve.com/cve/CVE-2025-22905.htmlSun, 05 Jul 2026 01:21:22 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a command injection vulnerability via the command parameter at /goform/mp.https://patchthecve.com/cve/CVE-2025-22904.htmlhttps://patchthecve.com/cve/CVE-2025-22904.htmlSun, 05 Jul 2026 01:21:21 +0000CRITICAL 9.8: RE11S v1.11 was discovered to contain a stack overflow via the pptpUserName parameter in the setWAN function.https://patchthecve.com/cve/CVE-2024-7616.htmlhttps://patchthecve.com/cve/CVE-2024-7616.htmlWed, 17 Jun 2026 08:20:33 +0000MEDIUM 5.5: A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcam_cgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this disclosu