Edimax BR-6428NS EUVD-2026-30721

Exploitation requires network reachability to the BR-6428NS web administration interface and a valid low-privileged session on that interface (CVSS PR:L), meaning the attacker must either know the admin credentials, leverage factory defaults, or chain an authentication bypass. The specific feature required is the L2TP VPN client configuration page handled by /goform/formL2TPSetup, reached via the POST Request Handler; the vulnerable parameter is L2TPUserName. Limiting factors are: the device must be running firmware 1.10 (the only confirmed affected build), the web admin port must be reachable from the attacker's network position (typically LAN-only unless remote management is enabled on WAN), and no user interaction is needed (UI:N) once authenticated. Default WAN exposure of admin is uncommon out-of-box, which narrows realistic targeting to devices where owners enabled remote management or where the attacker is already on the LAN.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) yields a 7.4 score driven by network reach, low attack complexity, and high impact across confidentiality, integrity, and availability, but it requires low-privilege authentication (PR:L) to the web interface - meaning attackers need valid (or default) admin credentials. Exploit maturity is flagged Proof-of-Concept (E:P) and a public writeup is hosted on Notion, so weaponization is straightforward; however, there is no CISA KEV entry and no EPSS score in the provided data to quantify in-the-wild activity. Real-world risk is concentrated on devices where the WAN-side admin interface is exposed or where default/weak credentials remain - a common SOHO failure mode - and is further compounded by vendor silence, which means no patch is forthcoming and exploitation will outlast disclosure. Conflicting signal to note: the description says 'initiate the attack remotely' but the CVSS vector requires PR:L authentication, so 'remote' here means network-reachable rather than fully unauthenticated.

An attacker who has obtained admin credentials - through default-password reuse, phishing of the LAN owner, or pivoting from a compromised internal host - sends a crafted HTTP POST to /goform/formL2TPSetup with an oversized L2TPUserName field. The overflow corrupts the httpd stack frame and, given the absence of typical embedded-firmware mitigations, can be turned into code execution as root using the published PoC, granting the attacker full router control to pivot, sniff traffic, alter DNS, or persist on the network edge.