CVE-2025-28146

This is a flaw where the router’s software can be tricked into running system-level commands based on a value sent in a web request (fota_url). In plain terms, it’s like someone finding a “phone home” feature on your router and turning it into a way to run code on the router itself. Because it’s network-based and doesn’t require a login, it can be abused remotely if the router can be reached.

This matters if you use an Edimax BR-6478AC V3 router running firmware 1.0.15. It may also be relevant to Edimax BR-6476AC based on the affected product list provided.

Actively reachable risk depends on whether an attacker can reach the router’s web interface/endpoint from the network—because the vulnerability does not require authentication, the key gate is network exposure (for example, the router being accessible from the internet or from an untrusted network).

Treat this as urgent because the vulnerability allows remote attackers to execute arbitrary commands without authentication or user interaction. Even though no official KEV entry or public exploit code was found in the provided sources, the impact (router takeover) is severe and the issue is serious enough to warrant prompt mitigation or firmware update.