A vulnerability was found in Edimax BR-6478AC V2 1.23 and classified as critical . This affects the function setWAN of the file /goform/setWAN of the component POST Request Handler . The manipulation of the argument pppUserName/pptpUserName/L2TPUserName results in command injection. This vulnerability is known as CVE-2026-12807 . It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.