Which versions of Edimax BR-6478AC are affected by CVE-2026-9443?

The Edimax BR-6478AC router contains a remote buffer overflow vulnerability (CVE-2026-9443) in its L2TP configuration interface that enables memory corruption and potential device compromise.

Is there a public PoC exploit available for CVE-2026-9443?

Yes, a public proof-of-concept exploit is available for CVE-2026-9443. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9443?

24 hours: Discover and document all Edimax BR-6478AC devices in your network, including firmware versions and administrative interface exposure. 7 days: Implement network segmentation to restrict access to the device's administrative interface; disable L2TP functionality where operationally feasible. 30 days: Execute device replacement or upgrade plan; establish monitoring for any future vendor firmware releases.

Edimax BR-6478AC CVE-2026-9443

Q: What is the CVSS score of CVE-2026-9443?

CVE-2026-9443 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31655 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-25 VulDB

GHSA-349r-6q9h-2pfh

Buffer Overflow Br 6478Ac

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:52 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory by submitting a crafted L2TPUserName parameter to the /goform/formL2TPSetup endpoint. Publicly available exploit code exists (VulDB-published POC on Notion), and SSVC rates technical impact as total despite a low 0.04% EPSS score. The vendor was contacted but has not responded, leaving the device without an official fix.

Technical ContextAI

The affected component is the formL2TPSetup handler within the BR-6478AC's HTTP-based administrative web interface (typical of Realtek/Edimax SoC-based SOHO routers running a lighttpd/boa-derived goform CGI stack). The vulnerability is a classic CWE-120 classic buffer copy without checking input size, where the L2TPUserName POST parameter is copied into a fixed-size stack or heap buffer without bounds validation, enabling memory corruption that can overwrite adjacent control data such as return addresses. CPE cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* identifies the affected product line; the EUVD record narrows the confirmed-vulnerable firmware to version 1.23.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure. Until a firmware update is published on the Edimax support portal, operators should remove the BR-6478AC's web administration interface from any WAN/internet exposure and restrict access to a trusted management VLAN, since the bug is reachable via authenticated POST and PR:L means credentialed LAN users can still trigger it. Disable the L2TP server feature entirely if not in use, which removes the formL2TPSetup configuration path that contains the vulnerable parser (trade-off: L2TP VPN termination on the router will no longer be configurable from the UI). Replace default administrator credentials with strong unique ones, monitor the VulDB record https://vuldb.com/vuln/365424 and the Notion POC writeup at https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formL2TPSetup-34b53a41781f809e9c30c1260cc5d92e for updated mitigation guidance, and consider replacing end-of-support consumer hardware with a currently maintained model given the vendor's non-response posture.