EUVD-2026-31655
GHSA-349r-6q9h-2pfh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory by submitting a crafted L2TPUserName parameter to the /goform/formL2TPSetup endpoint. Publicly available exploit code exists (VulDB-published POC on Notion), and SSVC rates technical impact as total despite a low 0.04% EPSS score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) network reachability to the BR-6478AC HTTP administration interface (LAN by default; WAN only if remote management has been enabled), (2) valid low-privileged web-UI credentials per CVSS PR:L - the formL2TPSetup endpoint is behind authentication, so fully unauthenticated exploitation is not supported by the available data, and (3) the device running firmware 1.23 as listed in EUVD-2026-31655. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privileged web-UI credentials (default, reused, or phished) reaches the router's HTTP admin interface - directly on the LAN, via an exposed WAN management port, or through CSRF against a logged-in admin - and submits a POST to /goform/formL2TPSetup with an oversized L2TPUserName value. The overflow corrupts memory in the goform CGI handler, enabling crash-induced denial of service and, with the publicly available POC as a starting point, potential arbitrary code execution as the web server process (typically root on these SoC routers), yielding full device takeover and a foothold for pivoting into the LAN. |
| Remediation | No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Discover and document all Edimax BR-6478AC devices in your network, including firmware versions and administrative interface exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today