EUVD-2026-31529
GHSA-w59p-45j6-4rch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach router admin web interface
-
DeliveryAuthenticate with valid or default credentials
-
ExploitSend POST to /goform/formWanTcpipSetup with oversized pppUserName
-
InstallOverflow stack buffer in formWanTcpipSetup
-
C2Hijack saved return address
-
ExecuteExecute attacker shellcode on router
-
ImpactPivot into LAN or persist on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the BR-6428NS HTTP administrative interface and valid web-admin credentials (CVSS PR:L), and is bounded to firmware version 1.10 of the Edimax BR-6428NS exposing the /goform/formWanTcpipSetup endpoint. The attack does not require user interaction (UI:N) and can be performed by any authenticated user with access to the WAN configuration page; risk is amplified where the admin interface is WAN-exposed or where default/weak credentials are in use, and is limited where the admin UI is reachable only from trusted LAN segments with strong unique credentials. |
| Impact | The CVSS vector AV:N/AC:L/PR:L/UI:N indicates remote, low-complexity exploitation requiring some level of authentication (PR:L), which on a SOHO router typically means valid web-admin credentials - often left at vendor defaults on consumer deployments. Exploit code is publicly hosted on Notion (per the cveorg exploit reference) and the temporal vector shows E:P (Proof-of-Concept) and RC:R (Reasonable confidence), confirming a working POC rather than confirmed widespread weaponization. No EPSS score, SSVC decision, or CISA KEV listing was provided in the input, so real-world exploitation prevalence cannot be quantified; however, the combination of an unpatched end-of-life-class device, public POC, and full CIA impact warrants treating this as a priority for any operator still running the BR-6428NS, especially given the vendor's silence ensures no fix is forthcoming. Note that the description states 'launched remotely' yet CVSS requires PR:L - defenders should verify whether default or weak credentials effectively reduce this to an unauthenticated condition in practice. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed valid web-admin credentials (commonly default on SOHO routers) sends a crafted HTTP POST to /goform/formWanTcpipSetup containing an oversized pppUserName value, overflowing the stack buffer in formWanTcpipSetup and overwriting the saved return address to redirect execution into attacker-controlled shellcode. With publicly available exploit code referenced in the disclosure, the attacker gains code execution on the router and can pivot into the internal network, intercept traffic, or enroll the device into a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 23, 2026
Stack buffer overflow in the Edimax BR-6428NS 1.10 wireless router allows authenticated remote attackers to corrupt memory by sending an overlong pppUserName parameter to the /goform/formWanTcpipSetup endpoint. Publicly available exploit code exists, and the vendor failed to respond to the coordinated disclosure attempt, leaving devices without an official fix. With a CVSS of 8.8 and full CIA impact, successful exploitation can result in arbitrary code execution or device takeover on the embedded router.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor did not respond to the disclosure reported by VulDB. Operators should immediately restrict access to the router's web administration interface by ensuring it is not exposed to the WAN (disable any 'Remote Management' or 'WAN Access' settings) and by placing the LAN-side admin interface behind firewall rules limiting it to trusted management hosts only, accepting the trade-off of needing console or physical access for configuration changes. Change any default or weak admin credentials to mitigate the PR:L precondition, and given the BR-6428NS is a legacy consumer router with no responsive vendor, the most defensible long-term action is to replace the device with a currently-supported model; consult the VulDB record at https://vuldb.com/vuln/365241 and the public exploit write-up at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formWanTcpipSetup-34b53a41781f80049b27db22e62fd8fd for indicator and detection details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax BR-6428NS is a consumer-grade N150 wireless broadband router that exposes its administrative interface over HTTP through a series of 'goform' CGI handlers compiled into the embedded web server. The vulnerable function formWanTcpipSetup handles WAN configuration POST requests and copies the pppUserName argument into a fixed-size stack buffer without bounds validation, which matches the CWE-120 classic buffer copy without checking size of input. On MIPS/ARM-based SOHO routers like the BR-6428NS, such stack overflows typically overwrite the saved return address and can be leveraged for arbitrary code execution because the device firmware generally lacks modern mitigations such as ASLR, stack canaries, or non-executable stacks.
Know when Br 6428Ns gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax BR-6428NS 1.10 wireless routers contain a critical stack buffer overflow (CVE-2026-9294, CVSS 8.8) exploitable by authenticated remote attackers to achieve arbitrary code execution and complete device takeover. With publicly available exploit code and no vendor patch available, organizations deploying this router model face immediate risk of network infrastructure compromise and potential lateral movement into corporate systems.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict administrative interface access to trusted local networks via firewall rules, enforce strong authentication on administrative accounts, deploy network-based detection signatures for exploit attempts targeting the pppUserName parameter overflow, implement network segmentation isolating router functions from critical systems, and monitor administrative logs for unauthorized access. These controls reduce exploitation risk but do not eliminate the vulnerability; hardware replacement is required for permanent remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Stack buffer overflow in the Edimax BR-6428NS router (firmware 1.10) allows remote authenticated attackers to corrupt me
Stack buffer overflow in the Edimax BR-6428NS router firmware version 1.10 allows authenticated remote attackers to corr
Buffer overflow in the Edimax BR-6428NS 1.10 router's web management interface allows authenticated remote attackers to
Command injection in the Edimax BR-6428NS 1.10 wireless router's web management interface allows a remotely authenticate
Command injection in Edimax BR-6428NS firmware version 1.10 exposes the device's operating system to remote command exec
Command injection in Edimax BR-6428NS firmware v1.10 allows authenticated remote attackers to execute arbitrary system c
Exploit-DB