EUVD-2026-31605
GHSA-69c3-9259-5w7w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router HTTP admin interface
-
DeliveryAuthenticate with valid/default credentials
-
ExploitSend POST to /goform/formWlSiteSurvey with oversized selSSID
-
ExecutionOverflow fixed-size buffer in handler
-
PersistHijack control flow on embedded OS
-
ImpactExecute attacker code as web service user (typically root)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have network reachability to the router's HTTP administrative interface (LAN by default; WAN only if Remote Management is enabled) and must be able to authenticate to the admin panel - the CVSS PR:L flag indicates valid low-privilege credentials are required to reach the vulnerable /goform/formWlSiteSurvey handler. The target must specifically be Edimax BR-6675nD running firmware 1.12. No user interaction (UI:N) and no additional attack-time prerequisites (AT:N) are needed beyond authenticated POST access. Limiting factors: requirement for valid credentials, and the fact that consumer-router admin panels are usually not WAN-exposed; however, default credentials on this device class materially weaken the PR:L barrier in practice. |
| Impact | Mixed signals weigh against treating this as a top-priority issue despite the 7.4 CVSS-v4.0 score. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable exploitation requiring some level of authentication (PR:L) but no user interaction, with high confidentiality/integrity/availability impact on the vulnerable component. SSVC frames this as Exploitation=PoC, Automatable=no, Technical Impact=total - meaning a working concept exists but mass scanning/exploitation is unlikely. EPSS at 0.04% (13th percentile) reinforces low real-world exploitation likelihood, and the CVE is not in CISA KEV. The practical risk is constrained by the router admin panel typically being LAN-only; however, if administration is exposed to WAN or default/weak credentials are in use, the impact is total device compromise. Note: PR:L implies valid credentials, but consumer routers frequently ship with admin/admin defaults, materially raising real-world exposure beyond what PR:L suggests. |
| Exploit ScenarioDerived | An attacker who has obtained or reused router admin credentials (e.g., factory defaults, credential stuffing, or a foothold on the LAN) sends a POST request to /goform/formWlSiteSurvey with an over-long selSSID value, overflowing the fixed-size buffer in the form handler. Publicly available exploit code exists, lowering the barrier to weaponization for a targeted attacker; successful exploitation can crash the router (denial of service) or, with reliable shellcode tuned to the firmware's MIPS/ARM layout, yield code execution as the web server process - typically root on embedded routers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt memory by sending a crafted POST request with an oversized selSSID parameter to /goform/formWlSiteSurvey, potentially achieving code execution on the device. Publicly available exploit code exists (disclosed by VulDB), and the vendor was contacted early but did not respond, leaving the device without an official fix. EPSS probability is low (0.04%, 13th percentile) and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure. As compensating controls, restrict the router's web administration interface to trusted LAN segments only and explicitly disable Remote/WAN management (this prevents internet-borne exploitation but blocks legitimate remote admin), change default administrator credentials to long random values to make the PR:L precondition meaningfully harder, and block external access to TCP 80/443 on the WAN interface at any upstream firewall. Filter or drop POST requests to /goform/formWlSiteSurvey at any in-line WAF or reverse proxy if one is deployed (side effect: legitimate wireless site-survey scans from the admin UI will fail). Given the BR-6675nD is an older 802.11n device with an unresponsive vendor, the most durable mitigation is to replace the device with a currently-supported router. Reference: VulDB advisory at https://vuldb.com/vuln/365384 and the public PoC writeup at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formWlSiteSurvey-34b53a41781f80608091f104f17e1e9b.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The BR-6675nD is a consumer/SOHO 802.11n wireless router. The vulnerable code path is in the embedded web administration interface - specifically the formWlSiteSurvey handler reached via /goform/formWlSiteSurvey, a CGI-style endpoint typical of Realtek/Broadcom-based router firmware. The root cause maps to CWE-120 (classic buffer copy without checking input size), where the selSSID POST argument is copied into a fixed-size buffer without bounds validation, enabling stack or BSS memory corruption. CPE data confirms the single affected product as cpe:2.3:a:edimax:br-6675nd, with EUVD scoping the vulnerable build to firmware 1.12.
Know when Br 6675Nd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was determined in Edimax BR-6675nD 1.12. The impacted element is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component POST Request Handler. This manipulation of the argument selSSID causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
An unpatched vulnerability in Edimax BR-6675nD wireless routers (version 1.12) poses potential code execution risk to network infrastructure. Publicly available exploit code exists, but real-world exploitation remains statistically unlikely (0.04% probability) and is not documented in active attack campaigns. With the vendor unable to provide patches, this creates technical debt requiring planned device replacement within 90 days rather than emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative access via network segmentation-limit management interfaces to specific internal subnets only; (2) Enforce unique, complex passwords on all administrative accounts and disable default credentials; (3) Disable remote/WAN-accessible management interfaces where not required; (4) Enable logging and monitoring for all administrative access attempts; (5) Establish replacement timeline for affected devices within 90 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Exploit-DB