CVE-2025-28143
📋 TL;DR
This CVE describes a command injection vulnerability in Edimax AC1200 routers that allows authenticated attackers to execute arbitrary commands on the device. The vulnerability exists in the groupname parameter of the disk creation group form. Users of affected router models with the vulnerable firmware are at risk.
💻 Affected Systems
- Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full router compromise allowing attacker to install persistent backdoors, intercept all network traffic, pivot to internal networks, or brick the device.
Likely Case
Router takeover enabling traffic monitoring, DNS hijacking, credential theft, and lateral movement to connected devices.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to router admin interface.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Exploitation requires authentication but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Edimax website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Disk Sharing Feature
allDisable the disk sharing functionality that contains the vulnerable endpoint
Restrict Admin Interface Access
allLimit access to router admin interface to trusted IP addresses only
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Change default admin credentials and implement strong authentication
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via admin interface. If version is 1.0.15, device is vulnerable.Check Version:
Login to router admin interface and check System Status or Firmware Update sectionVerify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.15📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /boafrm/formDiskCreateGroup
- Suspicious command execution in system logs
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND (uri="/boafrm/formDiskCreateGroup" OR command="*;*" OR command="*|*")