Cyber Posture

CVE-2025-14094

MediumPublic PoC

Published: 05 December 2025

Published
05 December 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0012 30.0th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This manipulation of the argument sysCmd causes os command injection. The attack may be initiated remotely. The exploit has…

more

been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly prevents OS command injection by implementing input validation mechanisms on the vulnerable sysCmd argument in /boafrm/formSysCmd.

preventrecover

Mandates timely remediation of the identified command injection flaw through patches, configuration changes, workarounds, or device replacement despite vendor non-response.

prevent

Minimizes exposure to the vulnerable sysCmd function by prohibiting or restricting non-essential system command execution capabilities.

Security SummaryAI

CVE-2025-14094 is an OS command injection vulnerability affecting the Edimax BR-6478AC V3 firmware version 1.0.15. The flaw exists in the function sub_44CCE4 within the file /boafrm/formSysCmd, where manipulation of the sysCmd argument enables command injection. Published on 2025-12-05, it is associated with CWE-77 and CWE-78.

The vulnerability is exploitable remotely over the network (AV:N) with low attack complexity (AC:L), but requires high privileges (PR:H) and no user interaction (UI:N), with unchanged scope (S:U). Exploitation yields low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), resulting in a CVSS v3.1 base score of 4.7. Attackers with sufficient privileges can inject and execute arbitrary OS commands on the device.

No patches or mitigations are available from the vendor, who was contacted early but did not respond. An exploit has been published and may be used, with details available at https://github.com/Kriswu1337/CVE/blob/main/EDIMAX/1/3.md and related VulDB entries including https://vuldb.com/?ctiid.334484, https://vuldb.com/?id.334484, and https://vuldb.com/?submit.696668.

Details

CWE(s)

Affected Products

edimax
br-6478ac v3 firmware
1.0.15

MITRE ATT&CK Enterprise TechniquesAI

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
Why these techniques?

OS command injection in router web interface (/boafrm/formSysCmd) enables remote exploitation of public-facing application (T1190) for indirect command execution (T1202) and network device CLI abuse (T1059.008).

References