EUVD-2026-31592
GHSA-9cpg-3r7v-63jc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Edimax BR-6675nD 1.12. Affected is the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via an oversized L2TPUserName parameter sent to the /goform/formL2TPSetup endpoint, with publicly available exploit code exists. The vendor was notified early but has not responded, and no patch has been released, leaving deployed devices exposed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must have low-privilege authenticated access to the router's web management interface (CVSS PR:L) and network reachability to the HTTP service handling /goform/formL2TPSetup - typically the LAN interface by default, or the WAN interface only if remote administration has been explicitly enabled by the operator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 of 7.4 reflects network attack vector, low attack complexity, and low-privilege authentication (PR:L) requirement with high impact to confidentiality, integrity, and availability of the device itself (scope unchanged). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid (or default/guessed) admin credentials reaches the router's web interface - directly over the LAN, or over the WAN if remote management is enabled - and sends a crafted POST request to /goform/formL2TPSetup containing an oversized L2TPUserName value. The buffer overflow corrupts memory in the HTTP daemon, enabling arbitrary code execution as root on the device, which can then be used to pivot into the internal network, intercept traffic, or enroll the router into a botnet. … |
| Remediation | No vendor-released patch identified at time of analysis; Edimax was contacted by the reporter (VulDB) prior to public disclosure but did not respond. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Edimax BR-6675nD 1.12 devices in production and document network accessibility and critical dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today