CVE-2025-28145
📋 TL;DR
This CVE describes a command injection vulnerability in Edimax AC1200 routers that allows attackers to execute arbitrary commands on the device. The vulnerability exists in the disk formatting functionality and affects users of the specific router model and firmware version. Attackers can potentially gain full control of the router.
💻 Affected Systems
- Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, credential theft, network traffic interception, and pivot to internal network devices.
Likely Case
Router takeover leading to DNS hijacking, credential harvesting, and network disruption for connected devices.
If Mitigated
Limited impact if router is behind firewall with restricted administrative access and network segmentation.
🎯 Exploit Status
Exploit requires authentication to the router's web interface. Public proof-of-concept code is available in the GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: Yes
Instructions:
1. Check Edimax website for firmware updates 2. Download latest firmware 3. Access router admin panel 4. Navigate to firmware update section 5. Upload and apply new firmware 6. Reboot router
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router web interface
Change default credentials
allUse strong, unique admin password
🧯 If You Can't Patch
- Replace router with supported model
- Isolate router in separate VLAN with strict firewall rules
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin panel. If version is 1.0.15, device is vulnerable.Check Version:
Login to router web interface and check System Status or Firmware Update page.Verify Fix Applied:
Verify firmware version has been updated to a version later than 1.0.15.📡 Detection & Monitoring
Log Indicators:
- Unusual disk format operations
- Suspicious command execution in system logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Unexpected port openings
SIEM Query:
source="router_logs" AND (event="disk_format" OR event="command_execution")