CVE-2025-14093 is a medium severity OS command injection flaw (CVSS 4.7) in Edimax BR-6478AC V3 router 1.0.15, affecting the traceroute diagnostic handler /boafrm/formTracerouteDiagnosticRun, through the host argument. No fix is listed and the vendor did not respond, so cut exposure and watch for a patch.
What's affected
The affected component is the traceroute diagnostic handler /boafrm/formTracerouteDiagnosticRun, through the host argument. According to the record, manipulating that argument leads to command injection and the attack can be started remotely.
Affected version: 1.0.15. The record names no fixed version and says the vendor was contacted early but did not respond.
The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. The attack vector is the network, but the vector lists high privileges required, which is why the score is lower: the attacker needs an administrative account first. The weakness classes are CWE-77, CWE-78.
The CVE record states that the exploit has been disclosed publicly. That is not the same as exploitation in the wild, which the record does not report, and the CISA Known Exploited Vulnerabilities flag is false. Still, public details lower the effort needed to attack an exposed instance.
How to check if you're exposed
This is device firmware, so the check is about inventory and exposure rather than a package version. Find out whether you have this model, which firmware it runs, and whether its management interface can be reached from outside.
- Log in to the device administration page and note the model name and firmware version. Compare it with the version in this post.
- From a machine outside your network, test whether the device web interface answers on its public address. If it does, that is your first thing to close.
- Check your asset list or DHCP leases for the device type, because routers in branch offices and homes are often missing from inventories.
nmap -p 80,443,8080 YOUR_PUBLIC_IP
Only scan addresses you own or are authorised to test. If the management page answers from the internet, restrict it before doing anything else.
What to do now
- Identify every Edimax BR-6478AC V3 unit and the firmware it runs.
- Turn off remote administration, and make sure the web interface is only reachable from a trusted management network.
- Change default or shared administrator passwords. The CVSS vector for this record needs an administrator login, so a strong password limits who can reach the vulnerable function.
- Segment the device so that a compromise of the router does not give access to internal servers.
- Check the vendor support page for newer firmware, and apply it after reading the release notes.
- If the vendor never ships firmware, plan to replace the device with a supported model.
Why it matters
Command injection is the case where input reaches a system command without being neutralised, so the device runs more than the feature intended. The weakness maps to CWE-77, CWE-78. It is a recurring problem on embedded devices, where web handlers often pass form values toward system calls.
Routers sit at the edge of the network, which raises the cost of any bug that runs code on them. A device that forwards your traffic and has a flaw in its management interface deserves the same patching attention as a server, even though few teams track it that way.
Quick check
Why does the score depend on logging in?
The attack vector is the network, but the vector lists high privileges required, which is why the score is lower: the attacker needs an administrative account first. A low or high privilege requirement lowers the score, but credentials on consumer-grade routers are often weak or shared, so do not treat it as protection.
What if the vendor never ships a fix?
The record names no fixed version and says the vendor was contacted early but did not respond. In that case the options are to isolate the device from untrusted networks or replace it with a supported model.
Sources
- Gold vulnerability page for CVE-2025-14093
- CVE record for CVE-2025-14093 as published by its CNA, with a published date of 2025-12-05
- Free in-browser dependency scan: gold.safeguard.sh/scan
Last reviewed: 19 October 2026.
