CVE-2026-1970
📋 TL;DR
This CVE describes an open redirect vulnerability in Edimax BR-6258n routers up to version 1.18. Attackers can manipulate the submit-url parameter to redirect users to malicious websites. Only end-of-life products are affected, and the vendor has confirmed no patches will be issued.
💻 Affected Systems
- Edimax BR-6258n
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially leading to full network compromise.
Likely Case
Attackers redirect users to phishing pages to harvest login credentials or display malicious ads.
If Mitigated
With proper network segmentation and user awareness, impact is limited to potential credential theft from individual users.
🎯 Exploit Status
Exploit details are publicly available and require minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None available - vendor confirmed product is end-of-life
Restart Required: No
Instructions:
No official patch available. Vendor recommends replacing affected hardware.
🔧 Temporary Workarounds
Network segmentation
allIsolate affected routers from critical network segments
Web filtering
allImplement DNS/web filtering to block malicious redirects
🧯 If You Can't Patch
- Replace affected routers with supported models
- Implement strict outbound web filtering and monitor for suspicious redirects
🔍 How to Verify
Check if Vulnerable:
Check router web interface version at http://router-ip/status.asp or similar status pageCheck Version:
curl -s http://router-ip/status.asp | grep -i versionVerify Fix Applied:
No fix available - replacement is the only verification method📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in web server logs
- Multiple requests to /goform/formStaDrvSetup with modified submit-url parameters
Network Indicators:
- HTTP 302 redirects to unexpected external domains
- Traffic patterns showing users being redirected from router interface to external sites
SIEM Query:
web.url="*/goform/formStaDrvSetup*" AND web.query="*submit-url=*" AND NOT web.query="*submit-url=about:blank*"