EUVD-2026-30720
GHSA-cc9m-6hq9-85vh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed BR-6428NS web UI
-
DeliveryObtain admin credentials (default/weak/CSRF)
-
ExploitSend POST to /goform/formPPTPSetup with oversized pptpUserName
-
ExecutionOverflow stack buffer in httpd
-
PersistHijack control flow or crash service
-
ImpactExecute code or persist on router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the device's HTTP management interface - typically the LAN side by default, but a serious risk on any unit configured for WAN/remote administration; (2) valid authenticated credentials to the admin web UI (CVSS PR:L), which on consumer devices often means default or weak credentials are sufficient; and (3) the ability to send an HTTP POST to /goform/formPPTPSetup with an oversized pptpUserName argument. No user interaction is required (UI:N). Limiting factors: the PR:L authentication requirement narrows the attack surface compared to a fully unauthenticated bug, and devices not exposing the web UI to the WAN are only reachable from the local network or via CSRF against an authenticated administrator. |
| Impact | CVSS 4.0 scores this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H - network-reachable, low complexity, but requiring low privileges (PR:L), meaning an authenticated session to the web UI is needed. E:P confirms a proof-of-concept exists. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified at time of analysis indicating mass exploitation, but publicly available exploit code exists which lowers the barrier for opportunistic attacks, particularly against devices exposed to the internet or where default/weak admin credentials are in use. The real-world risk is amplified by the vendor's confirmed non-response, meaning no patch is forthcoming and affected devices will remain vulnerable indefinitely; this is more dangerous in practice than the 7.4 score suggests for any device still in production. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed the router's admin credentials (or reaches a session via CSRF against a logged-in administrator) sends a crafted HTTP POST to /goform/formPPTPSetup with an overlong pptpUserName field, overflowing a stack buffer in the httpd process. Per the published exploit writeup on Notion, the overflow is reachable and reproducible, enabling at minimum a remote crash/DoS of the management daemon and potentially code execution in the httpd context depending on the firmware's memory protections. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – May 18, 2026
Stack buffer overflow in the Edimax BR-6428NS router (firmware 1.10) allows remote authenticated attackers to corrupt memory by sending an overlong pptpUserName parameter to the /goform/formPPTPSetup endpoint. Publicly available exploit code exists per VulDB disclosure, and no public exploit identified at time of analysis in CISA KEV. The vendor was reportedly contacted prior to disclosure but did not respond, leaving the device line without a confirmed fix.
Earlier versions of this analysis (1)
Buffer overflow in Edimax BR-6428NS router firmware version 1.10 enables authenticated remote attackers to execute arbitrary code via the pptpUserName parameter in the /goform/formPPTPSetup endpoint. Publicly available exploit code exists, though no active exploitation has been confirmed. The vendor failed to respond to disclosure attempts, leaving affected devices unpatched.
RemediationAI
No vendor-released patch identified at time of analysis, as Edimax did not respond to the coordinated disclosure attempt. Owners should treat the device as end-of-support for security purposes and consider replacement with a currently-maintained router. As compensating controls, restrict access to the web management interface (typically TCP/80 and TCP/443) to a trusted management VLAN or specific admin IPs via firewall ACLs - this trades off remote administration convenience for safety; ensure remote/WAN-side administration is fully disabled (side effect: admins must be on-LAN or VPN'd in to manage the device); change default admin credentials and rotate them, since exploitation requires PR:L authentication so strong credentials meaningfully raise the bar; if the PPTP VPN feature is not in use, do not configure it via the affected form (note that this does not remove the vulnerable code path, only reduces operational reasons to touch it). Monitor VulDB entry https://vuldb.com/vuln/364401 for any future vendor response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the formPPTPSetup handler inside the device's embedded web management interface (/goform/ is the typical Boa/GoAhead-style CGI binding used by many SOHO routers, including Edimax models). The root cause is CWE-120 (Classic Buffer Overflow / Buffer Copy without Checking Size of Input): the handler copies the user-supplied pptpUserName POST argument into a fixed-size stack buffer without bounds checking. Because embedded MIPS/ARM router firmware of this generation rarely enables stack canaries, ASLR, or non-executable stacks consistently, a stack overflow in a long-running httpd process can frequently be steered toward control-flow hijacking or, at minimum, a denial of service of the management plane. The affected CPE is cpe:2.3:a:edimax:br-6428ns covering firmware 1.10.
Know when Br 6428Ns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax BR-6428NS routers (firmware 1.10) are vulnerable to a remote buffer overflow that allows authenticated attackers to corrupt device memory. Publicly available exploit code exists, and no vendor patch is forthcoming, exposing organizations using this model to immediate risk of network infrastructure compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict access to router management interface via firewall rules, disable remote administrative access, implement network segmentation to isolate management plane, enforce strong authentication for any administrative access, and monitor management interface logs for suspicious connection attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Edimax BR-6428NS Buffer Overflow and Command Injection
View all 3Buffer overflow in the Edimax BR-6428NS 1.10 router's web management interface allows authenticated remote attackers to
Stack buffer overflow in the Edimax BR-6428NS 1.10 wireless router allows authenticated remote attackers to corrupt memo
Command injection in the Edimax BR-6428NS 1.10 wireless router's web management interface allows a remotely authenticate
Command injection in Edimax BR-6428NS firmware version 1.10 exposes the device's operating system to remote command exec
Exploit-DB