Edimax BR-6428NS CVE-2026-9295

Exploitation requires network reachability to the BR-6428NS web administration interface (typically TCP 80 on the LAN, or WAN if remote administration is enabled) and an authenticated administrative session, as indicated by CVSS PR:L - the attacker must be able to issue authenticated POST requests to /goform/formWirelessTbl. The specific trigger is supplying an oversized value in the vapurl POST parameter to the formWirelessTbl handler. Limiting factors: the attacker needs valid admin credentials (commonly defeated on consumer routers through default-credential reuse or LAN-side access), and the device must be running firmware version 1.10. No user interaction is required, and exploitation works against the device's default web stack without any non-default configuration.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable exploitation with low complexity, requiring low privileges (PR:L - typically an authenticated session) and no user interaction, with high impact across CIA. The E:P/RC:R temporal extensions indicate a proof-of-concept exploit with reasonable reporting confidence, consistent with the publicly released writeup. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no confirmed evidence of in-the-wild exploitation; however, publicly available exploit code exists, which materially raises opportunistic risk. PR:L conflicts somewhat with consumer router reality - many BR-6428NS units are deployed with default or weak admin credentials, effectively lowering the practical authentication barrier. The vendor's non-response to disclosure means no patch coordination is occurring, which substantially elevates long-term risk for any internet-exposed device.

An attacker who has obtained or guessed admin credentials (or who reaches the device on a network where the admin panel is exposed) sends a crafted POST request to /goform/formWirelessTbl containing an oversized vapurl parameter, overflowing a fixed-size buffer in the handler. Because a public PoC exists in the referenced Notion writeup, the technical barrier to weaponization is low. Successful exploitation crashes the device or, with proper payload construction, executes attacker-controlled code on the router, giving full control over routed traffic and the local network.