Description

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-31T15:18:11.063Z",
  "pubdate": "2026-08-31T15:18:11.063Z",
  "executiveSummary": "The Edimax BR-6214K firmware version 1.40 contains an OS command injection vulnerability located within the web management interface.\nThe vulnerability resides in the 'system' function of the 'www/wlanMP.asp' file, triggered via the 'ateFunc' argument.\nSuccessful exploitation allows a remote, unauthenticated attacker to execute arbitrary system commands with the privileges of the web server process.\nThis represents a critical security risk as it enables full compromise of the affected networking device, potentially leading to unauthorized network access, data interception, or the deployment of persistent malicious payloads.\nSince the vendor has remained unresponsive to disclosure efforts and public exploit code exists, the risk of exploitation by threat actors is considered high.\nThe vulnerability necessitates immediate network isolation or restricted access to the device management interface as no vendor-supplied patch is available.",
  "technicalDetails": "The vulnerability is an OS command injection flaw located in the 'asp_WlanMP' component of the Edimax BR-6214K firmware version 1.40.\nThe root cause is the improper sanitization of user-supplied input provided to the 'ateFunc' argument within the 'system' function call in the 'www/wlanMP.asp' file. The web application takes the input from the HTTP request and passes it directly to an underlying system shell or an insecure API call without adequate validation or escaping of metacharacters.\nThe attack flow begins with a remote attacker crafting a malicious HTTP request targeting the 'www/wlanMP.asp' endpoint. By appending arbitrary shell commands—typically using shell operators like semicolons (;), backticks (`), or pipes (|)—to the 'ateFunc' parameter, the attacker can break out of the intended command context.\nWhen the web server processes the request, the injected payload is executed by the system shell. Because the web interface service often runs with high-level privileges (frequently root or equivalent in embedded Linux firmware), the injected commands execute with full system authority.\nThis vulnerability is reachable remotely over the network, assuming the web interface is exposed. No authentication is explicitly required if the specific endpoint does not enforce a session check before executing the vulnerable 'system' call. The lack of input validation allows for the execution of arbitrary binary code, scripts, or system-level configuration changes.\nPost-exploitation impact includes the ability to modify device settings, exfiltrate sensitive configuration files, establish a reverse shell for persistent remote access, or utilize the device as a node in a broader botnet. The publicly available exploit code suggests that automated or manual exploitation by opportunistic actors is trivial. The absence of vendor response means that the vulnerability remains unpatched, providing no path for remediation other than network-level isolation or disabling the vulnerable web management functionality entirely."
}