External risk intelligence

RE11S Firmware Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-22906

The vulnerability exists in the firmware of a network device (RE11S) within the /goform/setWAN endpoint. Such devices, particularly repeaters and routers, are commonly deployed at the edge of networks, and administrative configuration interfaces on these devices are frequently accessible via the network to manage WAN settings.

Code Injection

Edimax Re11s Firmware

1.11

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in network devices, specifically affecting the RE11S firmware. This flaw allows unauthorized remote access and control, potentially impacting network security and data integrity. The main concern is confirming relevance and exposure across deployed devices.

Attackers can control network devices remotely.
Critical flaw allows unauthorized remote access.
Verify affected devices for potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the vulnerable device over the network. This request would target the WAN settings interface, specifically using the `L2TPUserName` parameter. If successful, this could allow the attacker to execute arbitrary commands on the device, potentially leading to a compromise of the device and its network.

Network access required.
Triggered via WAN configuration parameter.
Results in arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected device when reachable over the network, potentially impacting its functionality and configuration. The L2TPUserName parameter, when improperly handled, may permit malicious command injection. This could lead to unauthorized changes or disruption of the device's network services.

Device configuration and control.
Network-accessible endpoint.
Compromise of network functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The RE11S firmware's command injection vulnerability is likely to affect network infrastructure teams responsible for managing edge devices like wireless repeaters and routers. The first practical step is to identify all deployed RE11S devices, confirm their network exposure and business criticality, and then locate the accountable owner for remediation planning.

Network infrastructure teams should own this.
Verify device exposure and business criticality.
Plan remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Edimax RE11S?

The Edimax RE11S is a network device, typically functioning as a wireless repeater or range extender. These devices are used to expand the reach of a Wi-Fi network by receiving an existing wireless signal and rebroadcasting it. Because they operate at the network edge to bridge connections, they often include administrative interfaces for managing configuration settings like WAN parameters.

What is a command injection vulnerability?

A command injection vulnerability occurs when an application improperly handles user-supplied data, allowing an attacker to insert and execute their own operating system commands. In the case of CVE-2025-22906, the software fails to sanitize input provided to the L2TPUserName parameter, which the device then processes as a system instruction instead of simple text.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the device's /goform/setWAN endpoint. This does not happen through routine web browsing or standard Wi-Fi usage; it requires the attacker to target the administrative configuration interface directly. Requests that do not specifically interact with the vulnerable L2TPUserName parameter do not activate this command execution path.

Is my device at risk of this CVE?

If you are running the affected RE11S firmware, you should consider the risk based on network placement. Halo Surface Signal identifies this as an external-class vulnerability because repeaters are frequently placed at network edges where their management interfaces may be reachable. Devices tucked away on internal segments with restricted access have a different risk profile than those exposed directly to the internet.

What should I do if I manage RE11S devices?

Your first step is to inventory all RE11S units currently in operation to understand where they are deployed. Prioritize identifying devices that are accessible over the network. Once located, verify their firmware versions to confirm if they are running the affected 1.11 release, then consult official support channels for remediation guidance and planned updates.

References

www.edimax.com/edimax/global/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.