EUVD-2026-31604
GHSA-54gg-frw3-mp2g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed BR-6675nD admin interface
-
DeliveryAuthenticate with low-privilege/default credentials
-
ExploitPOST oversized pppUserName to /goform/formWanTcpipSetup
-
InstallOverflow buffer in HTTP handler
-
C2Hijack control flow for code execution
-
ExecutePersist via firmware/config modification
-
ImpactPivot to DNS hijack or LAN compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to reach the router's HTTP administration interface and authenticate with at least a low-privilege account (CVSS PR:L), so practical exploitation requires either (a) the device having WAN-side remote management enabled and the attacker holding or guessing valid credentials - including widely-known defaults - or (b) a position on the LAN with management-network access. Exploitation is specifically targeted at the formWanTcpipSetup POST handler with an oversized pppUserName parameter on Edimax BR-6675nD firmware 1.12; SSVC marks Automatable: no, indicating it is not trivially wormable. Limiting factors: PR:L authentication requirement, the niche affected device population, and the fact that most BR-6675nD deployments do not expose management to the WAN by default. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and indicates network-reachable, low-complexity exploitation requiring low privileges, with high confidentiality, integrity, and availability impact on the device itself (no scope change). SSVC rates Exploitation as 'poc', Automatable as 'no', and Technical Impact as 'total' - consistent with a device-takeover bug that still needs a valid web-UI credential. EPSS is very low (0.04%, 13th percentile) and the CVE is not in CISA KEV, suggesting no widespread opportunistic exploitation despite publicly available exploit code; this likely reflects the niche install base of this end-of-life consumer router rather than the bug being hard to weaponize. Key caveat: PR:L means the attacker needs at least router credentials (often default admin/admin on SOHO gear), which materially lowers the bar against poorly administered devices but is not equivalent to fully unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed low-privilege web-UI credentials (e.g., default factory credentials still in place, or harvested via phishing) reaches the router's management interface - directly over the internet if remote administration is enabled, or pivoting from a compromised LAN host - and submits a POST to /goform/formWanTcpipSetup with an oversized pppUserName value. The overflow corrupts memory in the embedded HTTP daemon, enabling code execution as the device's web service (typically root on these routers) and full device takeover suitable for DNS hijacking, traffic interception, or botnet recruitment. Publicly available exploit code exists at the referenced Notion writeup, lowering the development effort for a working PoC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low-level credentials to corrupt memory via a crafted pppUserName parameter sent to the /goform/formWanTcpipSetup endpoint. Publicly available exploit code exists (disclosed via VulDB and a Notion writeup), and SSVC rates the technical impact as total, though EPSS remains very low at 0.04%. The vendor did not respond to coordinated disclosure, leaving affected devices without a confirmed fix.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure, so a fixed firmware version cannot be cited. As compensating controls, restrict access to the router's HTTP management interface to the LAN only and explicitly disable WAN-side / remote administration (most BR-series firmware exposes a 'Remote Management' toggle); this prevents internet-borne exploitation but does not stop a malicious or compromised LAN client. Change any default web-UI credentials, since the CVSS vector requires PR:L and default passwords on this hardware are widely documented. Segment the router's management VLAN from untrusted endpoints and consider replacing the device, as the BR-6675nD is a legacy consumer model unlikely to receive future security updates; primary references for tracking any vendor response are https://nvd.nist.gov/vuln/detail/CVE-2026-9401 and the VulDB entry https://vuldb.com/vuln/365382.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the formWanTcpipSetup handler in the router's embedded HTTP server (commonly a goform-style CGI handler used in Realtek/Broadcom-based SOHO firmware), which processes WAN PPPoE configuration POST requests. The root cause is CWE-120 (Classic Buffer Overflow): the pppUserName argument is copied into a fixed-size stack or BSS buffer without bounds checking, allowing memory corruption. The affected CPE cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* indicates the entire BR-6675nD product line at firmware 1.12 is in scope, and embedded MIPS/ARM router firmware of this era typically lacks modern stack protections (canaries, ASLR, NX), making overflows directly exploitable for control-flow hijack.
Know when Br 6675Nd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Edimax BR-6675nD 1.12. Impacted is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The Edimax BR-6675nD wireless router (firmware 1.12) contains a remotely exploitable buffer overflow in its web management interface that allows attackers with low-level credentials to corrupt device memory. Publicly available exploit code exists with no vendor patch forthcoming, creating a persistent risk to any organization deploying this router model for network infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict web management interface access to trusted networks only via firewall rules; (2) Disable remote management if not operationally required; (3) Enforce strong, unique credentials for all administrative accounts; (4) Monitor management interface access logs for suspicious authentication attempts or unusual parameter values; (5) Consider isolating affected routers to non-critical network segments if replacement cannot occur within 30 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Exploit-DB