CVE-2023-31983

This is a classic embedded-router takeover: the mp function inside /bin/webs on the Edimax BR-6428NS passes attacker-controlled input to a command interpreter with, in the advisory's words, no limitations. An unauthenticated request over the network becomes arbitrary command execution on the device, running as the router's own high-privilege firmware process. Whoever sends the request owns the gateway.

Flaws in this exact shape — unauthenticated command injection in a SOHO router web interface — are the staple diet of Mirai-style botnets. They get folded into automated scanners fast, sprayed indiscriminately at every reachable device, and a compromised router becomes a DDoS node, a traffic interception point, or a foothold onto the LAN behind it. Consumer routers like this are also frequently past end-of-life, so a fix may simply not exist.

Our emphasis is internet-exposure and lifecycle. The single most important question is whether any BR-6428NS presents its web interface to the WAN side, because that is where the botnets are looking. Given the age of this hardware we plan around replacement rather than patching, and where one of these is still routing traffic, we treat it as compromise-prone infrastructure to be retired, not maintained.