Edimax BR-6675nD CVE-2026-9399

Exploitation requires (1) network reachability to the router's HTTP administration interface, which by default listens only on the LAN unless remote management has been enabled, (2) valid low-privilege web UI credentials per the CVSS PR:L designation - in practice typically the device admin account, often left at vendor defaults on this consumer model, and (3) the ability to send an authenticated POST to /goform/formsetPPPoE with an oversized pppUserName parameter to the formsetPPPoE handler. No user interaction is required (UI:N). Exploitation is limited to firmware version 1.12 of the Edimax BR-6675nD as confirmed by EUVD, and SSVC Automatable=no indicates the exploit is not suitable for unattended mass scanning, narrowing realistic risk to targeted attacks against reachable, credentialed admin panels.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low-privilege authentication - meaning a valid web UI session is needed, which on consumer routers is often the well-known default admin/admin credential pair. SSVC corroborates this with Exploitation=poc, Automatable=no, and Technical Impact=total, signaling severe outcome per device but no worm-style mass exploitation. EPSS is very low at 0.04% (13th percentile), and the CVE is not in CISA KEV, suggesting public exploit code exists but is not being broadly weaponized in the wild - consistent with an end-of-life SOHO device with limited internet exposure of its admin panel. The key tension is between the public exploit plus total impact (high per-target severity) and the unauthenticated-WAN-management precondition that most deployments do not satisfy, so risk concentrates on devices with admin interfaces reachable from untrusted networks (LAN attackers, or WAN-side admin exposure).

An attacker who has gained access to the router's web admin interface - for example a malicious user on the LAN, a guest Wi-Fi client who recovered the default admin password, or an attacker exploiting an exposed WAN-side admin panel - logs in and issues a POST to /goform/formsetPPPoE with an oversized pppUserName value. The overflow overwrites the saved return address in the formsetPPPoE handler and redirects execution to attacker-controlled shellcode, yielding code execution at the privilege level of the web server process (typically root on these embedded devices) and full device takeover suitable for traffic interception, DNS hijacking, or pivoting into the LAN. A public proof-of-concept describing the request shape is published at the referenced Notion page.