EUVD-2026-31605
GHSA-69c3-9259-5w7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Edimax BR-6675nD 1.12. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. This manipulation of the argument selSSID causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt memory by sending a crafted POST request with an oversized selSSID parameter to /goform/formWlSiteSurvey, potentially achieving code execution on the device. Publicly available exploit code exists (disclosed by VulDB), and the vendor was contacted early but did not respond, leaving the device without an official fix. EPSS probability is low (0.04%, 13th percentile) and the issue is not listed in CISA KEV.
Technical ContextAI
The BR-6675nD is a consumer/SOHO 802.11n wireless router. The vulnerable code path is in the embedded web administration interface - specifically the formWlSiteSurvey handler reached via /goform/formWlSiteSurvey, a CGI-style endpoint typical of Realtek/Broadcom-based router firmware. The root cause maps to CWE-120 (classic buffer copy without checking input size), where the selSSID POST argument is copied into a fixed-size buffer without bounds validation, enabling stack or BSS memory corruption. CPE data confirms the single affected product as cpe:2.3:a:edimax:br-6675nd, with EUVD scoping the vulnerable build to firmware 1.12.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure. As compensating controls, restrict the router's web administration interface to trusted LAN segments only and explicitly disable Remote/WAN management (this prevents internet-borne exploitation but blocks legitimate remote admin), change default administrator credentials to long random values to make the PR:L precondition meaningfully harder, and block external access to TCP 80/443 on the WAN interface at any upstream firewall. Filter or drop POST requests to /goform/formWlSiteSurvey at any in-line WAF or reverse proxy if one is deployed (side effect: legitimate wireless site-survey scans from the admin UI will fail). Given the BR-6675nD is an older 802.11n device with an unresponsive vendor, the most durable mitigation is to replace the device with a currently-supported router. Reference: VulDB advisory at https://vuldb.com/vuln/365384 and the public PoC writeup at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formWlSiteSurvey-34b53a41781f80608091f104f17e1e9b.
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today