EUVD-2026-87833
GHSA-hwrh-7vqj-6wg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web admin (LAN)
-
DeliveryAuthenticate as low-priv user
-
ExploitPOST oversized interface1/interface2 to /goform/formWizSurvey
-
ExecutionOverflow stack buffer in Wizard handler
-
PersistHijack control flow
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the device's HTTP management interface and low-privileged authentication (CVSS PR:L), then sending manipulated interface1/interface2 parameters to the /goform/formWizSurvey Wireless Wizard Handler endpoint. Limiting factors: the admin web interface on this SOHO router is typically bound to the LAN, so exploitation usually requires local network position or an exposed/forwarded management port; valid credentials or an authenticated session are needed, and only firmware version 1.16 of the BR-6428nC is named as affected. |
| Impact | Signals conflict sharply on severity. The vendor (VulDB) CVSS 4.0 base score of 2.1 (AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L) drastically understates a stack-based buffer overflow (CWE-121): a memory-corruption primitive in an embedded C binary realistically yields code execution or device crash, warranting HIGH vulnerable-system impacts, not the 'Low' triad VulDB assigned. There is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation; however, publicly available exploit code exists (Notion writeup by researcher tzh00203), lowering the barrier to weaponization. The 'E:P' (Proof-of-Concept) in the vector corroborates POC-only maturity. Practically, this is authenticated (PR:L) and gated behind reaching the router's web management interface - typically LAN-side on a consumer/SOHO device - which constrains real-world blast radius. Net: treat as a genuine post-authentication RCE/DoS risk on affected devices, but with LOW priority overall due to niche/legacy footprint, LAN-adjacency in most deployments, and absence of active-exploitation signals. The published CVSS 2.1 should NOT be trusted as the risk driver. |
| Exploit ScenarioDerived | An attacker who can reach the Edimax BR-6428nC web admin interface and possesses low-privilege credentials (or a session on an open/weakly-protected LAN management panel) sends a crafted request to /goform/formWizSurvey with an oversized interface1 or interface2 argument, overflowing a stack buffer in the Wireless Wizard handler. This corrupts saved return state to crash the device or execute attacker-controlled code on the router. A public proof-of-concept for this exact endpoint is already published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Stack-based buffer overflow in the Edimax BR-6428nC wireless router (firmware version 1.16) allows an authenticated remote attacker to corrupt memory by sending crafted interface1 or interface2 parameters to the /goform/formWizSurvey endpoint, potentially achieving code execution or causing a denial of service. Publicly available exploit code exists, and the severity signals conflict sharply: the CVE publisher assigned a CVSS 4.0 score of 2.1 (low), while our independent assessment rates it 8.8 (high) under CVSS 3.1 due to high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) has been reported at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis. Until a firmware update is available, restrict access to the router's web management interface so that it is reachable only from trusted LAN segments-disable WAN/remote management, block inbound access to the device's management web interface at the network perimeter, and avoid forwarding the management port; the trade-off is loss of legitimate remote administration. Replace default administrative credentials with a strong unique password and remove any unnecessary low-privileged accounts, since the attack requires PR:L and valid authentication is a prerequisite. If the wireless wizard feature is not essential, consider disabling it in the firmware, though this may not be possible on all builds and could affect initial setup workflows. Monitor the VulDB advisory at https://vuldb.com/vuln/410616 and Edimax support channels for a patched firmware release, and apply it promptly once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic stack-based buffer overflow (CWE-121) in the wireless wizard handler of the Edimax BR-6428nC's HTTP management interface. The /goform/formWizSurvey endpoint processes user-supplied interface1 and interface2 arguments without proper bounds checking, copying them into a fixed-size stack buffer and allowing an attacker to overwrite adjacent stack memory such as saved return addresses. The CPE cpe:2.3:a:edimax:br-6428nc:*:*:*:*:*:*:*:* identifies the Edimax BR-6428nC as the affected product, and the EUVD advisory specifies firmware 1.16 as the affected version. Exploitation is remote (AV:N) but requires the attacker to reach the router's web management interface and to hold low-privileged credentials (PR:L per CVSS 4.0 and CVSS 3.1 vectors), which in typical SOHO deployments limits practical exposure to the LAN or an exposed/forwarded management port. The public CVSS 4.0 vector (E:P) marks exploit code as proof-of-concept, and the independent CVSS 3.1 assessment (8.8) reflects high impact, whereas the CVE publisher's 2.1 score reflects low impact-this discrepancy should be resolved by vendor confirmation.
Know when Br 6428Nc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L), post-authentication (PR:L, low-priv web login), and a stack overflow in embedded firmware plausibly yields full device compromise (C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Buffer overflow in Edimax BR-6428nC router firmware (version 1.16 and earlier) allows authenticated remote attackers to
Command injection in Edimax BR-6428nC router web interface through the /goform/setWAN endpoint allows authenticated remo
Open redirect in the Edimax BR-6428nC router firmware (1.16) allows a remote, unauthenticated attacker to steer a victim
Exploit-DB