CVE-2025-14093
📋 TL;DR
This CVE describes an OS command injection vulnerability in Edimax BR-6478AC V3 routers. Attackers can remotely execute arbitrary commands by manipulating the 'host' parameter in the traceroute diagnostic function. All users of affected router versions are vulnerable to potential system compromise.
💻 Affected Systems
- Edimax BR-6478AC V3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router takeover allowing installation of persistent backdoors, network traffic interception, lateral movement to connected devices, and bricking of the device.
Likely Case
Router configuration modification, credential theft, DNS hijacking, and creation of botnet nodes for DDoS attacks.
If Mitigated
Limited impact with proper network segmentation, but still potential for router compromise if exposed.
🎯 Exploit Status
Public exploit details available on GitHub. Attack requires no authentication and uses simple command injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Disable web interface remote access
allPrevent external access to the vulnerable web interface
Access router admin interface -> Advanced Settings -> Remote Management -> Disable
Block traceroute diagnostic page
linuxUse firewall rules to block access to the vulnerable endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/boafrm/formTracerouteDiagnosticRun" --algo bm -j DROP
🧯 If You Can't Patch
- Segment affected routers in isolated VLANs with strict firewall rules
- Implement network monitoring for unusual outbound connections from routers
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.0.15, device is vulnerable.Check Version:
Login to router web interface and check System Status or About pageVerify Fix Applied:
No fix available to verify. Monitor for firmware updates from vendor.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formTracerouteDiagnosticRun with shell metacharacters
- Router logs showing command execution attempts
Network Indicators:
- Unexpected outbound connections from router to external IPs
- DNS queries for command-and-control domains from router
SIEM Query:
source="router_logs" AND uri="/boafrm/formTracerouteDiagnosticRun" AND (host="*;*" OR host="*|*" OR host="*`*" OR host="*$(*")