Which versions of Edimax BR-6428NS are affected by CVE-2026-9294?

Edimax BR-6428NS 1.10 wireless routers contain a critical stack buffer overflow (CVE-2026-9294, CVSS 8.8) exploitable by authenticated remote attackers to achieve arbitrary code execution and…

Is there a public PoC exploit available for CVE-2026-9294?

Yes, a public proof-of-concept exploit is available for CVE-2026-9294. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9294?

Within 24 hours: Conduct inventory of all Edimax BR-6428NS 1.10 units in production and assess their role in network security architecture. Within 7 days: Implement firewall rules restricting WAN access to administrative functions, disable remote management capabilities, and isolate devices from critical network segments. Within 30 days: Replace all affected routers with current, patched alternatives; if replacement is not feasible, decommission units handling sensitive or production traffic.

Edimax BR-6428NS CVE-2026-9294

Q: What is the CVSS score of CVE-2026-9294?

CVE-2026-9294 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31529 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-23 VulDB

GHSA-w59p-45j6-4rch

Buffer Overflow Br 6428Ns

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 23, 2026 - 08:15 vuln.today

DescriptionCVE.org

A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack buffer overflow in the Edimax BR-6428NS 1.10 wireless router allows authenticated remote attackers to corrupt memory by sending an overlong pppUserName parameter to the /goform/formWanTcpipSetup endpoint. Publicly available exploit code exists, and the vendor failed to respond to the coordinated disclosure attempt, leaving devices without an official fix. With a CVSS of 8.8 and full CIA impact, successful exploitation can result in arbitrary code execution or device takeover on the embedded router.

Technical ContextAI

The Edimax BR-6428NS is a consumer-grade N150 wireless broadband router that exposes its administrative interface over HTTP through a series of 'goform' CGI handlers compiled into the embedded web server. The vulnerable function formWanTcpipSetup handles WAN configuration POST requests and copies the pppUserName argument into a fixed-size stack buffer without bounds validation, which matches the CWE-120 classic buffer copy without checking size of input. On MIPS/ARM-based SOHO routers like the BR-6428NS, such stack overflows typically overwrite the saved return address and can be leveraged for arbitrary code execution because the device firmware generally lacks modern mitigations such as ASLR, stack canaries, or non-executable stacks.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor did not respond to the disclosure reported by VulDB. Operators should immediately restrict access to the router's web administration interface by ensuring it is not exposed to the WAN (disable any 'Remote Management' or 'WAN Access' settings) and by placing the LAN-side admin interface behind firewall rules limiting it to trusted management hosts only, accepting the trade-off of needing console or physical access for configuration changes. Change any default or weak admin credentials to mitigate the PR:L precondition, and given the BR-6428NS is a legacy consumer router with no responsive vendor, the most defensible long-term action is to replace the device with a currently-supported model; consult the VulDB record at https://vuldb.com/vuln/365241 and the public exploit write-up at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formWanTcpipSetup-34b53a41781f80049b27db22e62fd8fd for indicator and detection details.