EUVD-2026-31655
GHSA-349r-6q9h-2pfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed BR-6478AC admin UI
-
DeliveryObtain low-priv web credentials
-
ExploitPOST oversized L2TPUserName to /goform/formL2TPSetup
-
ExecutionOverflow goform stack buffer
-
PersistHijack control flow as router root
-
ImpactPivot into LAN or persist on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the BR-6478AC HTTP administration interface (LAN by default; WAN only if remote management has been enabled), (2) valid low-privileged web-UI credentials per CVSS PR:L - the formL2TPSetup endpoint is behind authentication, so fully unauthenticated exploitation is not supported by the available data, and (3) the device running firmware 1.23 as listed in EUVD-2026-31655. No user interaction is required (UI:N), and attack complexity is low (AC:L). Limiting factors: PR:L means credential acquisition or default-password reuse is a prerequisite, the bug lives in the L2TP configuration handler so deployments that block access to /goform/formL2TPSetup at the proxy/ACL layer prevent reach, and the SSVC Automatable=no rating indicates the exploit chain is not trivially scalable to mass scanning. |
| Impact | Signals are mixed. CVSS 4.0 rates this 7.4 (High) with AV:N/AC:L/PR:L/UI:N and full CIA impact (VC:H/VI:H/VA:H), and SSVC marks technical impact as 'total' - consistent with arbitrary code execution on the device. However, EPSS is only 0.04% (13th percentile), SSVC marks Automatable=no, and the device is not in CISA KEV, indicating no observed mass exploitation. The PR:L requirement means an attacker must possess valid (potentially default or weak) admin credentials before reaching formL2TPSetup, which materially limits opportunistic exploitation. Real-world risk is moderate and skewed toward targeted attacks against internet-exposed BR-6478AC admin panels or LAN-resident attackers chaining with credential theft; the publicly disclosed POC and unresponsive vendor elevate longer-term concern. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged web-UI credentials (default, reused, or phished) reaches the router's HTTP admin interface - directly on the LAN, via an exposed WAN management port, or through CSRF against a logged-in admin - and submits a POST to /goform/formL2TPSetup with an oversized L2TPUserName value. The overflow corrupts memory in the goform CGI handler, enabling crash-induced denial of service and, with the publicly available POC as a starting point, potential arbitrary code execution as the web server process (typically root on these SoC routers), yielding full device takeover and a foothold for pivoting into the LAN. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory by submitting a crafted L2TPUserName parameter to the /goform/formL2TPSetup endpoint. Publicly available exploit code exists (VulDB-published POC on Notion), and SSVC rates technical impact as total despite a low 0.04% EPSS score. The vendor was contacted but has not responded, leaving the device without an official fix.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure. Until a firmware update is published on the Edimax support portal, operators should remove the BR-6478AC's web administration interface from any WAN/internet exposure and restrict access to a trusted management VLAN, since the bug is reachable via authenticated POST and PR:L means credentialed LAN users can still trigger it. Disable the L2TP server feature entirely if not in use, which removes the formL2TPSetup configuration path that contains the vulnerable parser (trade-off: L2TP VPN termination on the router will no longer be configurable from the UI). Replace default administrator credentials with strong unique ones, monitor the VulDB record https://vuldb.com/vuln/365424 and the Notion POC writeup at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formL2TPSetup-34b53a41781f809e9c30c1260cc5d92e for updated mitigation guidance, and consider replacing end-of-support consumer hardware with a currently maintained model given the vendor's non-response posture.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the formL2TPSetup handler within the BR-6478AC's HTTP-based administrative web interface (typical of Realtek/Edimax SoC-based SOHO routers running a lighttpd/boa-derived goform CGI stack). The vulnerability is a classic CWE-120 classic buffer copy without checking input size, where the L2TPUserName POST parameter is copied into a fixed-size stack or heap buffer without bounds validation, enabling memory corruption that can overwrite adjacent control data such as return addresses. CPE cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* identifies the affected product line; the EUVD record narrows the confirmed-vulnerable firmware to version 1.23.
Know when Br 6478Ac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The Edimax BR-6478AC router contains a remote buffer overflow vulnerability (CVE-2026-9443) in its L2TP configuration interface that enables memory corruption and potential device compromise. Publicly available exploit code exists with no vendor patch expected, creating unmitigated risk for organizations deploying this device. Immediate network isolation and access controls are critical to prevent exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation to isolate affected devices; (2) Restrict administrative interface access through firewall rules; (3) Disable L2TP if not operationally required; (4) Monitor administrative logs for anomalous L2TP configuration attempts; (5) Enforce strong authentication controls for administrator accounts accessing these devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corru
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Exploit-DB