EUVD-2026-31591
GHSA-rw38-jf8v-3hg8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed BR-6675nD admin interface
-
DeliveryObtain admin credentials (default/brute-force)
-
ExploitSend POST to /goform/formPPPoESetup with oversized pppUserName
-
ExecutionTrigger stack buffer overflow in handler
-
PersistCrash device or execute shellcode as web service
-
ImpactPivot into LAN or maintain rogue config
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the BR-6675nD's HTTP management interface (typically TCP/80 on the LAN, or WAN if remote administration is enabled) and low-privileged authenticated access to the admin panel as indicated by CVSS PR:L, since the /goform/formPPPoESetup endpoint sits behind the router's login. The attacker must specifically be running firmware version 1.12 of the BR-6675nD and able to issue a POST to /goform/formPPPoESetup with a malicious pppUserName argument. No user interaction is required (UI:N), and the published PoC writeup lowers the effort barrier; the principal practical limit is obtaining admin credentials, which is often trivial on SOHO routers left at defaults. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4 and indicates network-reachable, low-complexity exploitation, but requires low privileges (PR:L) - meaning an authenticated session on the web admin interface is needed, which is consistent with the /goform/formPPPoESetup endpoint typically being behind admin authentication. EPSS is very low at 0.04% (13th percentile), and the CVE is not listed in CISA KEV, signaling no observed widespread exploitation. However, publicly available exploit code exists (E:P in the CVSS vector, and a notion.site writeup is referenced), the vendor is unresponsive, and SOHO routers frequently retain default credentials - so the practical risk is elevated for any internet-exposed device. The biggest uncertainty is whether code execution is actually achievable on this embedded target or whether the overflow only causes denial of service; the public PoC writeup should be consulted to confirm. |
| Exploit ScenarioDerived | An attacker on the LAN - or on the internet if remote admin is enabled - who has obtained admin credentials (default, brute-forced, or phished) sends a crafted POST request to /goform/formPPPoESetup with an oversized pppUserName field, triggering the stack buffer overflow. Using the publicly available PoC documented on notion.site, the attacker may crash the router (denial of service) or, if a working ROP chain against the device's MIPS/ARM firmware is developed, achieve code execution as the web server process to pivot into the internal network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a malicious pppUserName parameter to the /goform/formPPPoESetup endpoint. Publicly available exploit code exists, raising the risk of opportunistic targeting despite a low EPSS score of 0.04%, and the vendor has not responded to coordinated disclosure attempts.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early about this disclosure but did not respond. Owners of the BR-6675nD should treat this device as end-of-support and replace it with a currently supported router; until replacement, restrict access to the web management interface to trusted LAN hosts only by disabling remote/WAN administration (this prevents internet-based exploitation but does not block a malicious LAN-side authenticated user), change the admin password from defaults to reduce the chance of an attacker meeting the PR:L precondition, and segment the router off any sensitive internal networks. Monitor the Edimax support site and vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-9381 for any future firmware update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the formPPPoESetup CGI handler exposed via the router's HTTP management interface (/goform/formPPPoESetup), which processes PPPoE configuration POST requests. According to CWE-120 (Classic Buffer Copy without Checking Size of Input), the pppUserName argument is copied into a fixed-size stack or heap buffer without bounds checking, allowing oversized input to overwrite adjacent memory. The affected CPE cpe:2.3:a:edimax:br-6675nd represents a consumer/SOHO wireless broadband router, typical of the embedded MIPS/ARM Linux platforms where such goform handlers in the boa/httpd web server commonly suffer from unchecked strcpy/sprintf patterns.
Know when Br 6675Nd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Edimax BR-6675nD 1.12. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A memory corruption vulnerability (CVE-2026-9381, CVSS 7.4) in the Edimax BR-6675nD wireless router affects organizations relying on this gateway for network and perimeter security services. Publicly available exploit code exists, creating immediate risk of opportunistic targeting and potential remote network compromise. With no patch available from the vendor, this represents a critical operational and security risk requiring urgent mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement access control lists (ACLs) limiting administrative access to this router from trusted networks/IPs only; deploy IDS/IPS detection signatures for malicious pppUserName parameter submissions to /goform/formPPPoESetup endpoint. Isolate affected router on dedicated management VLAN; restrict data flows through this device to essential network functions only. Equipment replacement is the primary mitigation strategy, with network segmentation providing interim protection during the transition period.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memo
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Exploit-DB