CVE-2026-7683 — An Unknown Function Of The File /Goform/SetWAN Of The Compon Command Injection

title: CVE-2026-7683 - Edimax BR-6428nC /goform/setWAN Command Injection
id: scw-2026-05-03-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-7683 by targeting the /goform/setWAN endpoint on Edimax BR-6428nC devices. The rule specifically looks for the presence of 'pppUserName' or 'pptpUserName' parameters in the URI query, combined with characters commonly used in command injection payloads such as spaces, backticks, semicolons, or pipes, indicating an attempt to inject arbitrary commands.
author: SCW Feed Engine (AI-generated)
date: 2026-05-03
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7683/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/goform/setWAN'
      cs-uri-query|contains:
          - 'pppUserName='
          - 'pptpUserName='
      cs-uri-query|contains:
          - ' ' 
      cs-uri-query|contains:
          - '`'
      cs-uri-query|contains:
          - ';'
      cs-uri-query|contains:
          - '|'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse