CVE-2026-96892

Executive Summary

CVE-2026-96892 is an open redirect vulnerability in the Edimax BR-6428nC wireless router running firmware version 1.16, specifically within the websRedirect function of the goform handler component. An unauthenticated remote attacker can manipulate the submit-url argument to redirect users to arbitrary external domains, typically leveraged for phishing or credential harvesting. With a CVSS base score of 4.3, the impact is moderate and requires user interaction (clicking a crafted link) to succeed, but the exploit is publicly available and multiple endpoints are affected. The vendor has not responded to disclosure, leaving all BR-6428nC devices on firmware 1.16 without an official fix.

Technical Analysis

The vulnerability resides in the websRedirect function, which is part of the goform handler component of the Edimax BR-6428nC firmware version 1.16. This handler is responsible for processing HTTP requests directed at the device's web management interface. Under normal operation, websRedirect likely takes a URL parameter (the submit-url argument) and issues an HTTP redirect to that location—for example, after a form submission or login attempt, to return the user to a requested page.

However, the function fails to validate or restrict the destination URL supplied in the submit-url argument. Because the application does not enforce a whitelist of allowed internal paths or check whether the target belongs to the same origin, an attacker can supply an arbitrary external URL. When a victim's browser receives the redirect response, it will navigate to the attacker-controlled domain. This is a classic CWE-601 (URL Redirection to Untrusted Site / Open Redirect) flaw.

The attack surface is the router's web management interface, which is typically accessible over HTTP on the local network or remotely if administration is exposed to the WAN. The NVD description notes that "multiple endpoints are affected," indicating that more than one handler or parameter path may invoke the vulnerable websRedirect logic. No authentication is required to trigger the redirect (PR:N), but the victim must be convinced to click a crafted link (UI:R). The vulnerability affects confidentiality and integrity only at a low level (C:N/I:L/A:N), reflecting that the redirect itself does not directly compromise the device or exfiltrate data—it simply serves as a launchpad for further social engineering.

Notably, no technical details about the exact endpoint paths, parameter encoding, or the precise redirect implementation are provided beyond the function name websRedirect and the argument submit-url. Therefore, analysis must remain at the vulnerability-class level: the application accepts an unvalidated URL in a request parameter and uses it to construct an HTTP redirect response.

Exploitation Scenarios

1. Reconnaissance and target identification: An attacker scans the internet or a local network for Edimax BR-6428nC devices. This can be done via Shodan using dorks such as product:"Edimax BR-6428nC" or http.html:"goform". Once a target is found, the attacker identifies the web management interface accessible on the router's IP address.

2. Triggering the flaw: The attacker crafts a URL that points to the router's management interface and includes the submit-url parameter set to an external malicious domain. Because multiple endpoints are affected, the attacker can choose any endpoint that calls websRedirect and accepts the submit-url argument. The crafted URL might look like: http://<router-ip>/goform/<endpoint>?submit-url=http://evil.example.com/phish. The exact endpoint path is not specified in the available description, so the attacker would need to discover it by inspecting the firmware or fuzzing common goform endpoints.

3. Payload/execution method: The attacker sends the crafted link to a victim via email, SMS, or a messaging app, often disguised as a legitimate router administration link or a firmware update notification. The victim clicks the link, and their browser sends a request to the router. The router's websRedirect function processes the submit-url parameter and issues an HTTP 302 (or similar) redirect to the attacker's domain. The victim's browser follows the redirect, landing on the attacker's phishing page, which may mimic the router's login page or another trusted site to steal credentials or deliver malware.

4. Post-exploitation impact: The immediate impact is limited to the redirect. However, the attacker can use the trusted nature of the router's IP address (often on a private network) to bypass user suspicion. Successful phishing can lead to credential theft, further malware installation, or lateral movement within the victim's network. Since the router itself is not compromised, the attacker does not gain direct control over the device, but the redirect can be used to harvest sensitive information or as part of a larger campaign. No public PoC code is available, but the vulnerability is confirmed by the NVD description as exploitable.

Impact Assessment

The CVSS v3.1 base score is 4.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The subscores indicate:

• Attack Vector (AV:N): The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC:L): No special conditions are required; the attack is straightforward.
• Privileges Required (PR:N): No authentication is needed to trigger the redirect.
• User Interaction (UI:R): The victim must click a link for the attack to succeed.
• Scope (S:U): The impact is confined to the vulnerable component (the router's web interface).
• Confidentiality (C:N): No direct loss of confidentiality from the redirect itself.
• Integrity (I:L): Low integrity impact—the redirect can alter the user's intended navigation.
• Availability (A:N): No impact on availability.

The blast radius includes all Edimax BR-6428nC devices running firmware 1.16. These are typically small office/home office (SOHO) routers, so the affected population is broad but the per-device impact is moderate. The open redirect can be used to facilitate phishing campaigns, which may lead to credential compromise, financial loss, or further network intrusion. Because the vendor is unresponsive and no patch exists, the risk remains persistent. The EPSS score is not yet available, and the vulnerability is not listed in CISA KEV, indicating no known active exploitation in the wild at this time. However, the public exploit availability raises the likelihood of future attacks.

Detection Guidance

Sigma Rule

title: Edimax BR-6428nC Open Redirect via submit-url Parameter
id: 8a2f3c1e-4b5d-4e6f-9a7b-2c3d4e5f6a7b
status: experimental
description: Detects HTTP requests to Edimax BR-6428nC devices attempting to exploit CVE-2026-96892 open redirect by manipulating the submit-url parameter with an external URL.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: edimax
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains: 'submit-url='
  filter_internal:
    cs-uri-query|contains:
      - 'submit-url=http://192.168.'
      - 'submit-url=https://192.168.'
      - 'submit-url=http://10.'
      - 'submit-url=https://10.'
      - 'submit-url=/'
      - 'submit-url=http://127.0.0.1'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate redirects to external sites if configured by administrator
level: medium
tags:
  - attack.t1204
  - cve.2026.96892

YARA Rule

rule CVE_2026_96892_Edimax_OpenRedirect
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-96892 open redirect in Edimax BR-6428nC firmware via the submit-url parameter"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96892"
        severity = "medium"

    strings:
        $s1 = "submit-url=" ascii wide nocase
        $s2 = "goform" ascii wide nocase
        $s3 = "websRedirect" ascii wide nocase
        $s4 = "http://" ascii wide nocase
        $s5 = "https://" ascii wide nocase

    condition:
        ($s1 and $s2) or ($s1 and $s3) or ($s2 and $s3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96892 Edimax BR-6428nC Open Redirect Attempt via submit-url"; flow:to_server,established; content:"submit-url="; http_uri; nocase; content:"http"; http_uri; nocase; distance:0; within:20; reference:cve,2026-96892; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-96892; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  http.request.uri contains "submit-url=" and
  (
    http.request.uri contains "http://" or
    http.request.uri contains "https://"
  ) and
  not http.request.uri contains "submit-url=http://192.168." and
  not http.request.uri contains "submit-url=https://192.168." and
  not http.request.uri contains "submit-url=http://10." and
  not http.request.uri contains "submit-url=https://10." and
  not http.request.uri contains "submit-url=http://127.0.0.1"

Splunk SPL Query

index=web OR index=proxy
| search (uri="*goform*" OR uri="*submit-url*")
| regex uri="submit-url=(http|https)://"
| regex uri!="submit-url=(http|https)://(192\.168\.|10\.|127\.0\.0\.1)"
| stats count values(uri) as uris by src_ip, dest_ip, http_user_agent
| where count > 0

Wazuh OSSEC Rule

<group name="edimax,cve-2026-96892,">
  <rule id="100200" level="7">
    <if_sid>31100</if_sid>
    <match>submit-url=</match>
    <regex>submit-url=(http|https)://</regex>
    <description>CVE-2026-96892: Possible Edimax BR-6428nC open redirect attempt via submit-url parameter with external URL</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>open_redirect,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the router's web management interface. Disable remote administration (WAN-side access) if not strictly required. Ensure the admin interface is only reachable from trusted internal networks.
   • Deploy network-level filtering to block HTTP requests containing suspicious submit-url parameters with external URLs. Use the Suricata or firewall rules provided above to alert or block such traffic.
   • Educate users not to click unsolicited links that point to router IP addresses, especially those containing redirect parameters. Implement email and web gateway protections against phishing.
   • Consider placing the router behind a reverse proxy that validates redirect destinations or strips external URLs from the submit-url parameter.

2. Patch/upgrade steps:

   • No official patch is available. Contact Edimax support to request a firmware update. Monitor the Edimax website and security advisories for any future firmware release addressing CVE-2026-96892.
   • If an updated firmware becomes available, upgrade immediately following the vendor's instructions. Verify the firmware version after installation.
   • If the device is end-of-life or no patch is forthcoming, consider replacing the router with a supported model from a vendor with a responsive security process.

3. Long-term hardening:

   • Implement a vulnerability management program that includes firmware review for network devices. Regularly check for CVEs affecting your hardware.
   • Enforce network segmentation to isolate IoT and SOHO devices from critical assets.
   • Use DNS filtering to block known malicious domains, reducing the effectiveness of open redirect phishing.
   • Adopt a zero-trust approach for management interfaces: require authentication, use HTTPS, and restrict by IP address.
   • Monitor for unusual redirect patterns in web logs as part of continuous security monitoring.

References

1. NVD – CVE-2026-96892: https://nvd.nist.gov/vuln/detail/CVE-2026-96892
2. CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): https://cwe.mitre.org/data/definitions/601.html
3. Edimax BR-6428nC product page (for firmware updates): https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wireless_routers_br-6428nc/
4. MITRE ATT&CK T1204 – User Execution: https://attack.mitre.org/techniques/T1204/
5. CISA KEV Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing. The public exploit availability increases the risk of future opportunistic attacks.