EUVD-2026-31596
GHSA-2jp2-2mm5-5h78
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Executing a manipulation of the argument pptpUserName can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to corrupt memory and potentially execute arbitrary code via an oversized pptpUserName POST parameter to /goform/formPPTPSetup. Publicly available exploit code exists (SSVC: PoC), though EPSS estimates exploitation probability at only 0.04% (13th percentile), reflecting the niche, end-of-life nature of the device. The vendor was notified prior to disclosure but did not respond, leaving affected units without an official fix.
Technical ContextAI
The flaw is a classic CWE-120 classic buffer overflow in formPPTPSetup, a CGI-style handler in the BR-6675nD's web administration interface that processes POST requests to /goform/formPPTPSetup. The pptpUserName argument is copied into a fixed-size stack buffer without bounds checking, a long-standing pattern in embedded SOHO router firmware that typically uses unsafe string functions such as strcpy or sprintf against user-supplied form fields. The affected CPE cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* covers the BR-6675nD line, a legacy Edimax 802.11n wireless router whose firmware is built on a small embedded HTTP daemon without modern memory protections, meaning overflows of this class are frequently leveraged for control-flow hijack.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure, so administrators should treat the BR-6675nD 1.12 as unsupported and plan replacement with a currently-maintained router as the primary remediation. Until replacement, restrict access to the web administration interface to trusted management hosts only by ensuring remote/WAN administration is disabled (this prevents internet-side abuse but does not block a malicious or compromised LAN client), change any default admin credentials to long random values to raise the bar against the PR:L precondition, and specifically avoid configuring or leaving the PPTP client/server feature enabled on the device, since the vulnerable handler is reached through that configuration page. Monitor VulDB entry https://vuldb.com/vuln/365345 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-9382 for any future vendor response.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today