Edimax BR-6428nC EUVD-2026-26822

Requires valid authentication credentials to the router's web administration interface (PR:L per CVSS vector). The vulnerable /goform/setWAN endpoint is only accessible to authenticated users with administrative privileges. Exploitation requires the WAN configuration feature to be enabled and accessible - this is default behavior in standard router deployments. The attack targets the PPTP gateway configuration functionality specifically, which processes the pptpDfGateway parameter without bounds checking. Limiting factors include: authentication barrier (though commonly bypassed via default credentials in SOHO deployments), requirement for network connectivity to the admin interface (commonly port 80/8080), and potential for exploitation attempts to crash the device if payload construction is incorrect. No user interaction required (UI:N) once authenticated. Does not require non-default configuration - standard factory settings are vulnerable.

The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with network attack vector (AV:N), low complexity (AC:L), and low privilege requirements (PR:L). The E:P (Proof-of-concept) modifier confirms exploit availability. While requiring authentication (PR:L), SOHO routers commonly use default or weak credentials, significantly lowering the real barrier to exploitation. The published Notion-hosted POC provides detailed technical analysis including stack overflow mechanics, making weaponization straightforward for moderately skilled attackers. Key risk factors: (1) remote exploitability against internet-facing admin interfaces, (2) complete device compromise potential given router context, (3) likely absence of modern exploit mitigations in embedded firmware, (4) vendor non-responsiveness suggests no patch forthcoming. Primary limiting factor is the authentication requirement, though this is frequently bypassed via credential reuse, brute force against common defaults, or chaining with authentication bypass vulnerabilities. This is a genuine priority for organizations using affected Edimax routers, particularly in networks where these devices handle sensitive traffic segmentation.

An attacker conducts reconnaissance to identify internet-exposed Edimax BR-6428nC admin panels (commonly on ports 80/443/8080), then attempts common default credentials (admin/admin, admin/1234, or blank passwords typical of SOHO routers). After successful authentication, the attacker sends a crafted HTTP POST request to /goform/setWAN with an oversized pptpDfGateway parameter exceeding buffer boundaries, overwriting the stack return address to redirect execution to attacker-controlled shellcode embedded in the payload. This achieves arbitrary code execution with root/administrative privileges in the router's operating context, enabling persistent backdoor installation, traffic interception, DNS hijacking for man-in-the-middle attacks, or pivoting into the internal network.