CVE-2025-70161

published 2026-01-09

CVE-2025-70161: EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system()…

Priority P2 75 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. This arises because the pppUserName field is directly passed to a shell command via the system() function without proper sanitization. An attacker can exploit this by injecting malicious commands into the pppUserName field, allowing arbitrary code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
edimax	br-6208ac_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /goform/setWAN↗

command pptpUserName=<payload containing ; | ` | \n | $>

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Edimax setWAN pptpUserName Parameter Command Injection Attempt (CVE-2025-70161)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:14; content:"/goform/setWAN"; fast_pattern; http.request_body; content:"pptpUserName|3d|"; pcre:"/^[^\x26]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Command-Injection-Vulnerability-in-Web-setWAN-handler-2d3b5c52018a80d7ae8dce2bf5e3294c; reference:cve,2025-70161; classtype:attempted-admin; sid:2066661; rev:1; metadata:affected_product Edimax, attack_target Networking_Equipment, tls_state plaintext, created_at 2026_01_09, cve CVE_2025_70161, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit traffic is HTTP (plaintext), POST method to /goform/setWAN with a body containing the pptpUserName parameter followed by shell metacharacters (;, |, `, newline, $) — monitor for these patterns on perimeter and internal network segments.
• → The vulnerable parameter name in the HTTP body is pptpUserName (note: NVD describes it as pppUserName, but the Snort rule and ET rule title use pptpUserName — monitor both variants). ↗
• → Injection is achieved via the system() function call with unsanitized user input; look for process spawning from the web server process on Edimax BR-6208AC V2 devices. ↗
• → Exploit reference writeup available at tzh00203.notion.site for additional PoC details.

• · The Snort/ET rule targets plaintext HTTP only (tls_state plaintext); if the management interface is ever exposed over HTTPS, this rule will not fire and additional TLS-inspection coverage is needed.
• · The URI match uses an exact byte-size constraint (bsize:14) for /goform/setWAN — any URL encoding or path variation may evade this specific signature.
• · NVD describes the vulnerable field as pppUserName while the Snort rule targets pptpUserName; both variants should be covered in custom detection logic to avoid blind spots. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77