Edimax BR-6478AC CVE-2026-9442

The attacker must reach TCP access to the BR-6478AC web administration interface and hold valid low-privileged web UI credentials (CVSS PR:L) - in practice the single admin account, which on consumer routers is frequently the unchanged factory default. The vulnerable code path is the formiNICSiteSurvey handler at /goform/formiNICSiteSurvey reached via a POST request with a manipulated selSSID parameter, so the device's HTTP admin service must be running and reachable from the attacker's network position. Limiting factors: no user interaction is required (UI:N), but exploitation is constrained to the specific Edimax BR-6478AC model running firmware 1.23, and impact is bounded to the device itself (Scope unchanged, SC:N/SI:N/SA:N) rather than chaining into the broader network without further steps.

CVSS 4.0 scores this 7.4 (High) with AV:N/AC:L/AT:N/PR:L/UI:N and high CIA impact - network reachable, low complexity, but requires low-privilege authentication (PR:L), meaning an attacker must have valid web UI credentials (often the default admin account on consumer routers). Threat-intelligence signals are mixed: a public exploit write-up exists (Notion page) and the issue is tagged 'Buffer Overflow', yet EPSS is only 0.04% (13th percentile) and the vulnerability is not on the CISA KEV list, suggesting opportunistic rather than mass exploitation today. The combination of an end-of-cycle consumer device, unresponsive vendor, and publicly documented PoC elevates long-term risk especially for internet-exposed admin interfaces or networks where default/weak credentials are common; conversely, the PR:L requirement and niche device population limit broad worm-style abuse. Note that 'low privileges' on a home router typically means the device's single admin user, so the practical authentication bar can be very low when defaults are unchanged.

An attacker who has reached the router's web interface - for example via a LAN foothold, a misconfigured WAN-exposed admin port, or default/weak credentials commonly left on consumer routers - authenticates and sends a crafted POST request to /goform/formiNICSiteSurvey containing an overlong selSSID value, triggering the buffer overflow in the handler. A public exploit write-up is hosted on Notion describing the vulnerable parameter, lowering the barrier to weaponization for arbitrary code execution or persistent denial of service on the device. Successful exploitation can be used to brick the router, pivot into the LAN, or install firmware-resident implants for traffic interception.