Edimax BR-6675nD CVE-2026-9380

Attacker must have low-privilege authenticated access to the router's web management interface (CVSS PR:L) and network reachability to the HTTP service handling /goform/formL2TPSetup - typically the LAN interface by default, or the WAN interface only if remote administration has been explicitly enabled by the operator. The L2TP client configuration form must be reachable via the authenticated UI (standard on BR-6675nD firmware 1.12). Limiting factors: requires valid credentials (mitigated in practice by widespread use of default/weak passwords on SOHO devices), constrained to the specific BR-6675nD 1.12 firmware build, no user interaction required (UI:N), and exploitation is not automatable per SSVC - meaning targeted rather than worm-style abuse is the expected mode.

CVSS 4.0 of 7.4 reflects network attack vector, low attack complexity, and low-privilege authentication (PR:L) requirement with high impact to confidentiality, integrity, and availability of the device itself (scope unchanged). SSVC aligns with this: exploitation status is 'poc', not 'active', not automatable, but technical impact is total - consistent with full device compromise once the attacker has any authenticated session. EPSS at 0.04% (13th percentile) suggests no observed mass exploitation, and the vulnerability is NOT in CISA KEV, so this is not confirmed actively exploited; however, publicly available exploit code exists via the linked Notion writeup, which raises the floor for opportunistic abuse. The authentication requirement (PR:L) is the primary risk-limiter - but SOHO routers are notorious for default/weak credentials and credential reuse, meaning the practical barrier is lower than CVSS implies. Net assessment: a real but bounded priority - high impact per-device, low population-wide exploitation pressure, no vendor patch.

An attacker with valid (or default/guessed) admin credentials reaches the router's web interface - directly over the LAN, or over the WAN if remote management is enabled - and sends a crafted POST request to /goform/formL2TPSetup containing an oversized L2TPUserName value. The buffer overflow corrupts memory in the HTTP daemon, enabling arbitrary code execution as root on the device, which can then be used to pivot into the internal network, intercept traffic, or enroll the router into a botnet. Publicly available exploit code exists (linked Notion writeup), lowering the skill barrier for opportunistic actors.