Vulnerability Title: Open Redirect in Multiple goform Handlers of Edimax BR-6428nC via submit-url

Discovered by: tzh00203

Contact Information: [email protected]

Affected Version: Edimax BR-6428nC firmware based on the provided GPL source package (the exact public firmware version string should be confirmed on the test image before submission)

Component: boa form handlers using websRedirect(), such as formStats

1. Vulnerability Overview

An open redirect vulnerability exists in multiple goform handlers of Edimax BR-6428nC. These handlers read a user-controlled submit-url parameter and pass it directly to websRedirect(), which ultimately emits it as the Location header if it already begins with http://.

This behavior enables an attacker to redirect a victim from the router interface to an arbitrary attacker-controlled external site.

2. Detailed Description

Several handlers follow the same pattern:

submitUrl = websGetVar(wp, T("submit-url"), T(""));
if (submitUrl[0])
    websRedirect(wp, submitUrl);

Representative examples include:

• formStats
• formReboot
• formRoute
• several VPN and management handlers

The redirect implementation is:

int websRedirect(request *req, char *url)
{
    send_redirect_perm(req, url);
}