EUVD-2026-33485
GHSA-cvrm-g72g-prqf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in Edimax BR-6478AC 1.23. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.
AnalysisAI
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corrupt memory by sending a crafted pppUserName parameter to the /goform/formWanTcpipSetup endpoint. Publicly available exploit code exists (published via VulDB and a Notion writeup), elevating this from a theoretical issue to a practical threat, though no CISA KEV listing or active exploitation has been confirmed. The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact on the device itself, with exploitation requiring only low-level authentication.
Technical ContextAI
The Edimax BR-6478AC is a consumer/SOHO AC1200 dual-band wireless router. The vulnerable code path lies in the formWanTcpipSetup handler within the device's embedded HTTP administration interface (/goform/), which processes WAN configuration POST requests. CWE-121 (Stack-Based Buffer Overflow) indicates the pppUserName argument is copied into a fixed-size stack buffer without adequate length validation, allowing an over-long input to overwrite adjacent stack memory including saved return addresses. SOHO router firmware of this generation typically runs on MIPS or ARM with limited exploit mitigations (often no stack canaries, no ASLR, NX inconsistently applied), making such overflows historically reliable to weaponize into arbitrary code execution on the router's underlying Linux/BusyBox userland.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax has not published a fixed firmware version in the available references. As compensating controls, administrators should immediately disable remote/WAN-side access to the router's web administration interface (most consumer routers expose this only on LAN by default, but verify), which eliminates internet-borne exploitation at the cost of remote management convenience. Change default admin credentials to strong unique values to raise the PR:L authentication bar that gates this vulnerability, and segment the router's management VLAN away from untrusted internal hosts to limit insider exploitation paths. Where the device is end-of-life or unsupported, replacement with a maintained model is the durable fix; monitor Edimax's support pages and the VulDB entry at https://vuldb.com/vuln/367419 for patched firmware availability.
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today