Description

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-31T15:18:12.503Z",
  "pubdate": "2026-08-31T15:18:12.503Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within the Edimax BR-6214K firmware version 1.40. The flaw is located in the asp_setPing endpoint, specifically within the www/ping.asp file. This vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands with the privileges of the web server process by injecting malicious input into the pingstr argument. The absence of adequate input validation and sanitization when passing parameters to system-level calls creates a significant security risk, potentially leading to full device compromise. Given that the exploit code is publicly available and the vendor has failed to provide a response or patch, the attack surface remains exposed, allowing malicious actors to gain unauthorized control over the affected network equipment.",
  "technicalDetails": "The vulnerability originates from insecure handling of user-supplied data within the function system of the www/ping.asp component. The asp_setPing endpoint accepts a parameter identified as pingstr, which is intended to facilitate diagnostic ping requests from the device interface. The root cause of the flaw is the application's failure to sanitize or validate the content of the pingstr argument before passing it directly to a system shell command execution function.\nDuring the exploitation process, an attacker can append shell metacharacters (such as ';', '&', or '|') to the pingstr argument. Because the application logic does not properly escape these inputs, the underlying operating system interprets the appended sequence as additional command instructions. This effectively breaks out of the intended binary execution context, allowing for the injection and execution of arbitrary OS commands.\nThe attack flow follows a straightforward remote exploitation vector: first, the attacker identifies the target endpoint (www/ping.asp) on the Edimax BR-6214K device. Second, the attacker crafts a malicious HTTP request (typically a POST request) containing the targeted pingstr parameter, incorporating an embedded system command designed for reconnaissance, credential harvesting, or backdoor deployment. Third, the request is transmitted over the network to the device's web management interface. Upon receiving the payload, the server-side script executes the command with the elevated privileges assigned to the web service, often resulting in root or equivalent system-level execution.\nPost-exploitation impact is severe, as the attacker gains the ability to manipulate the device's configuration, exfiltrate sensitive network traffic, launch secondary attacks against internal resources, or render the device non-functional. Because this is a remote execution vulnerability, it requires no physical access or prior authentication to initiate. The reliance on shell-based execution without restrictive sandboxing or input filtering constitutes a fundamental breakdown of the input processing logic, effectively enabling remote code execution (RCE) on the affected firmware version 1.40."
}