CVE-2025-28146

This is a flaw where the router’s software can be tricked into running system-level commands based on a value sent in a web request (fota_url). In plain terms, it’s like someone finding a “phone home” feature on your router and turning it into a way to run code on the router itself. Because it’s network-based and doesn’t require a login, it can be abused remotely if the router can be reached.

This matters if you use an Edimax BR-6478AC V3 router running firmware 1.0.15. It may also be relevant to Edimax BR-6476AC based on the affected product list provided.

Actively reachable risk depends on whether an attacker can reach the router’s web interface/endpoint from the network—because the vulnerability does not require authentication, the key gate is network exposure (for example, the router being accessible from the internet or from an untrusted network).

Treat this as urgent because the vulnerability allows remote attackers to execute arbitrary commands without authentication or user interaction. Even though no official KEV entry or public exploit code was found in the provided sources, the impact (router takeover) is severe and the issue is serious enough to warrant prompt mitigation or firmware update.

1. Confirm exposure and versions

   • Identify your exact router model (Edimax BR-6478AC V3 and/or Edimax BR-6476AC).
   • Record the current firmware version. The specific vulnerable firmware called out here is BR-6478AC V3 firmware 1.0.15.
   • Determine whether the router management/UI (and the affected path) is reachable from untrusted networks (internet or guest networks). Review router settings for remote administration, port forwarding, UPnP, or any public exposure.

2. Check for a fixed firmware

   • Contact Edimax support or check Edimax release notes for firmware that addresses CVE-2025-28146.
   • Upgrade only after confirming the release specifically fixes this issue (don’t rely on generic “security updates” language).

3. If you cannot upgrade immediately (mitigation)

   • Block inbound WAN access to router administration interfaces from the internet.
   • Remove any port-forwarding rules and disable UPnP if enabled.
   • Restrict access so that only trusted internal IPs can reach the router’s admin UI.
   • Add application-level filtering if available (WAF or reverse-proxy filtering) to block suspicious requests targeting fota_url (or the /boafrm/formLtefotaUpgradeQuectel endpoint) from the internet.

4. After upgrade / mitigation

   • Re-verify the router firmware version matches the fixed version.
   • Monitor router logs for repeated requests to the affected endpoint and unusual outbound behavior shortly after any exposure attempts.

5. Follow-up

   • If your business depends on the router for uptime, prioritize scheduling the upgrade window as soon as a confirmed fix is available from Edimax.

Severity: very high risk in practice because it is a remote command injection (CWE-94) with unauthenticated access and no user interaction requirement.

Mechanism/attack vector: an attacker can supply malicious input via the fota_url parameter used by the endpoint /boafrm/formLtefotaUpgradeQuectel, leading to arbitrary system command execution on the router over the network.

Exploitation status: no KEV listing was provided and no public exploit code was found in the provided sources; however, due to the impact, treat exposure as high priority.

Likelihood: EPSS was reported as a prediction only and should not be relied upon as proof of exploitation.

What KEV means here: the provided findings state CVE-2025-28146 is not listed in the CISA KEV set, so there is no confirmed KEV-based exploitation signal from the provided data.