Which versions of Edimax BR-6478AC V2 are affected by CVE-2026-12806?

Edimax BR-6478AC V2 wireless routers (firmware 1.23) contain a memory corruption vulnerability that allows low-privilege authenticated users to crash devices or potentially execute unauthorized code,…

Is there a public PoC exploit available for CVE-2026-12806?

Yes, a public proof-of-concept exploit is available for CVE-2026-12806. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-12806?

24 hours: Inventory all Edimax BR-6478AC V2 devices; restrict router management interface access via network ACLs; disable remote management if enabled. 7 days: Evaluate replacement with patched router models or assess alternative firmware availability; implement network segmentation isolating management traffic. 30 days: Execute device replacement plan or establish permanent access controls limiting management interface to hardened administrative networks.

Edimax BR-6478AC V2 CVE-2026-12806

Q: What is the CVSS score of CVE-2026-12806?

CVE-2026-12806 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-38192 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-21 VulDB

GHSA-93qv-48qr-mj84

Buffer Overflow Br 6478Ac V2 Edimax

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N/AC:L), requires valid web-UI credentials per CVSS 4.0 PR:L mapping to PR:L, no user interaction, full RCE as root on the device yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:11 vuln.today

CVSS changed

Jun 21, 2026 - 20:22 NVD

8.7 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability has been found in Edimax BR-6478AC V2 1.23. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack/heap buffer overflow in the Edimax BR-6478AC V2 wireless router (firmware 1.23) lets an authenticated attacker corrupt memory by sending an oversized selSSID parameter to the formWlSiteSurvey handler under /goform/, enabling denial of service and potentially arbitrary code execution on the device. Publicly available exploit code exists, but no public exploit identified at time of analysis as actively used in attacks (not in CISA KEV); the vendor was notified and did not respond, leaving devices unpatched. CVSS 4.0 base score is 7.4 reflecting network reachability of the management interface combined with required low-privilege authentication.

Technical ContextAI

The Edimax BR-6478AC V2 is a consumer/SOHO AC1200 dual-band wireless router whose web management interface exposes /goform/* CGI-style handlers implemented in the embedded HTTP daemon. The formWlSiteSurvey endpoint handles wireless site-survey POST submissions and copies the user-supplied selSSID argument into a fixed-size stack or heap buffer without bounds validation, the classic CWE-120 'Buffer Copy without Checking Size of Input' pattern. On MIPS/ARM-based embedded routers like this one, such overflows commonly overwrite saved return addresses or adjacent control structures in the httpd process, which typically runs as root with no ASLR, no stack canaries, and no NX, making memory corruption highly exploitable. The affected CPE is cpe:2.3:a:edimax:br-6478ac_v2:*:*:*:*:*:*:*:* covering firmware 1.23 per the EUVD record.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure, so administrators must rely on compensating controls. Restrict access to the router's web management interface to trusted LAN hosts only and disable any remote/WAN-side administration feature so the /goform/formWlSiteSurvey endpoint cannot be reached from the internet; this is the highest-leverage control given the bug requires reaching the HTTP handler. Change any default or weak administrative passwords to raise the PR:L authentication barrier, and place the device behind a segmented VLAN where untrusted client devices cannot send arbitrary POSTs to its management IP, accepting the trade-off that legitimate roaming clients triggering site surveys from the UI must come from that trusted segment. Monitor https://vuldb.com/vuln/372600 and https://nvd.nist.gov/vuln/detail/CVE-2026-12806 for any future vendor firmware update; if Edimax remains unresponsive, plan for hardware replacement with a supported model as the durable remediation.