Edimax BR-6478AC CVE-2026-10126

Exploitation requires network reachability to the router's HTTP administration interface (typically TCP/80 or TCP/443 on LAN by default, optionally on WAN if remote management is enabled) and valid low-privilege web-UI credentials (CVSS PR:L) to reach the authenticated /goform/formQoS handler. The target must be running Edimax BR-6478AC firmware version 1.23 (CPE wildcard suggests other versions may also be vulnerable but are not confirmed). No user interaction is required (UI:N), no special non-default feature toggle is named in the description, and the attack is a single HTTP POST manipulating the selSSID argument - meaning any reachable, credentialed attacker on a network path to the admin panel can trigger it. Limiting factors are therefore the credential requirement and exposure of the management interface; mitigating either substantially reduces realistic risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack requiring only low-level authentication and no user interaction, with high impact across confidentiality, integrity, and availability - appropriate for a router admin-panel bug. The E:P (Proof-of-Concept) exploit maturity is corroborated by the public write-up linked from VulDB, elevating practical risk above the base score. No EPSS score, KEV listing, or SSVC decision data was provided; without those, automatable/widespread exploitation cannot be confirmed, but the combination of remote vector, public PoC, and the fact that BR-6478AC web interfaces are sometimes exposed to the WAN (or accessible from any LAN client) makes this a credible priority for affected operators. PR:L (low privileges required) means an attacker still needs valid credentials, but SOHO routers are frequently deployed with default or weak admin passwords, eroding that limiting factor in practice.

An attacker with valid (or default/guessed) router admin credentials sends a crafted HTTP POST to /goform/formQoS with an oversized selSSID parameter, triggering the buffer overflow in the httpd process and overwriting saved return addresses or function pointers to gain arbitrary code execution as root on the device. A working proof-of-concept is publicly published in the linked Notion write-up, lowering the skill barrier for reproduction. From a compromised router, the attacker can pivot into the internal network, intercept or modify traffic, alter DNS/DHCP settings, and persist across reboots by modifying firmware-resident configuration.