CVE WatchJul 5, 2026

CVE-2026-36734

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input t

CVSS

8.8

High

EPSS

1.3%

p66

KEV

—

Exploit Today

0-100

Published: May 11, 2026 · Last modified: Jul 5, 2026 · CWE-77

EPSS · 30d

1.0%EPSS · 30 days1.3%

2026-06-302026-07-16

Technical description

EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection. An authenticated attacker with access to the network can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker is able to execute arbitrary system commands on the device.

Official references

github.comhttps://github.com/theShinigami/CVE-Disclosures/tree/main/CVE-2026-36734

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-422718.8 HIG

99.6%

KEV—80BerriAI LiteLLM Command Injection Vulnerability2d CVE-2023-349609.8 CRI

99.9%

——30A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.8d CVE-2023-376799.8 CRI

99.9%

——30A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.8d CVE-2026-80379.6 CRI

98.6%

——30OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints4d CVE-2022-457018.8 HIG

98.5%

——30Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.8d CVE-2023-337828.8 HIG

98.3%

——30D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.8d