Edimax BR-6675nD EUVD-2026-31596

Exploitation requires that the target device is an Edimax BR-6675nD running firmware 1.12 with the web administration interface reachable by the attacker and that the attacker holds valid admin-level credentials (CVSS PR:L), since /goform/formPPTPSetup is a post-login configuration endpoint for the PPTP feature. There is no user-interaction requirement (UI:N) and attack complexity is low (AC:L/AT:N), so once authenticated the malicious POST request alone is sufficient. Realistic limiting factors are the small installed base of this legacy model, the typical default of WAN-side admin being disabled, and the need to defeat or possess admin credentials - without those, the public PoC cannot be used directly against an arbitrary target.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores 7.4, indicating low-complexity network exploitation requiring low privileges (PR:L - i.e., an authenticated admin session) with total impact on confidentiality, integrity, and availability of the device. SSVC corroborates this with Technical Impact: total but Automatable: no, and Exploitation: poc rather than active. EPSS at 0.04% (13th percentile) is very low and the CVE is not in CISA KEV, which is consistent with a niche, end-of-life consumer device: high per-target impact but a small and shrinking installed base. The most important caveat is that PR:L conflicts with the public framing of "remote attack" - real-world risk depends heavily on whether the web UI is internet-exposed and whether default or weak admin credentials are in use, both common conditions for BR-series Edimax devices.

An attacker who has obtained admin credentials to the router's web UI - for example via default credentials, credential reuse, or a CSRF-style trick against an authenticated admin - sends a crafted POST to /goform/formPPTPSetup containing an oversized pptpUserName value, overflowing the stack buffer and overwriting saved return state to hijack execution on the MIPS/ARM router CPU. Because a public PoC has been published on the referenced Notion writeup, replication requires little reverse engineering, and successful exploitation typically yields full control of the router for traffic interception, DNS hijacking, or pivoting to the LAN.