Which versions of Edimax BR-6675nD are affected by CVE-2026-9380?

Edimax BR-6675nD router deployments running firmware 1.12 are vulnerable to network-based attacks enabling unauthorized code execution and system compromise; publicly available exploit code exists…

Is there a public PoC exploit available for CVE-2026-9380?

Yes, a public proof-of-concept exploit is available for CVE-2026-9380. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9380?

Within 24 hours: Inventory all Edimax BR-6675nD 1.12 devices in production and document network accessibility and critical dependencies. Within 7 days: Restrict management interface access to affected devices; disable L2TP configuration access if not operationally required; contact Edimax support to confirm patch development timeline. Within 30 days: Develop and deploy replacement or firmware upgrade strategy; implement logging and alerting on L2TP configuration endpoints for all affected devices.

Edimax BR-6675nD CVE-2026-9380

Q: What is the CVSS score of CVE-2026-9380?

CVE-2026-9380 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31592 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-24 VulDB

GHSA-9cpg-3r7v-63jc

Buffer Overflow Br 6675Nd

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:49 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax BR-6675nD 1.12. Affected is the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via an oversized L2TPUserName parameter sent to the /goform/formL2TPSetup endpoint, with publicly available exploit code exists. The vendor was notified early but has not responded, and no patch has been released, leaving deployed devices exposed. EPSS probability is low (0.04%, 13th percentile) but the combination of public POC, network reachability, and total technical impact (per SSVC) makes this a credible threat against unpatched edge devices.

Technical ContextAI

The Edimax BR-6675nD is a consumer/SOHO wireless router whose web management interface is implemented using the goform handler pattern common to Realtek/Broadcom-based embedded firmware. The vulnerable formL2TPSetup handler processes POST parameters for configuring an L2TP VPN client without bounds-checking the L2TPUserName field before copying it into a fixed-size buffer, matching CWE-120 (Classic Buffer Overflow / unbounded copy). On MIPS/ARM embedded targets typical of this device class, such overflows commonly enable stack corruption, return-address overwrite, and shellcode or ROP-based code execution under the privileges of the embedded HTTP daemon, which typically runs as root. The affected CPE is cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* with EUVD listing only firmware version 1.12 as confirmed affected.

RemediationAI

No vendor-released patch identified at time of analysis; Edimax was contacted by the reporter (VulDB) prior to public disclosure but did not respond. Until a firmware update is published, restrict access to the router's web management interface by disabling remote/WAN-side administration entirely and limiting LAN-side admin access to a dedicated management VLAN or trusted IPs - this defeats the network attack vector at the cost of administrative convenience. Specifically disable the L2TP client configuration feature if not in use, which removes the vulnerable formL2TPSetup code path from accessible attack surface but breaks any L2TP VPN connectivity that depends on it. Rotate the admin password to a strong unique value and audit for credential reuse, since PR:L means any authenticated session enables exploitation; this raises the bar but does not eliminate risk from insiders or credential theft. Monitor for replacement guidance from Edimax at the vendor support site, and for end-of-life devices consider replacement with a currently-supported router as the durable fix. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-9380 and https://vuldb.com/vuln/365343.