EUVD-2026-31600
GHSA-m37x-3837-x5f2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote authenticated attackers to corrupt memory and achieve total compromise via a crafted pppUserName parameter sent to /goform/formsetPPPoE. Publicly available exploit code exists and the vendor did not respond to the disclosure, leaving deployed devices exposed without an official fix. EPSS exploitation probability is low (0.04%) despite the public POC, but SSVC rates technical impact as total.
Technical ContextAI
The Edimax BR-6675nD is a consumer/SMB wireless N broadband router whose web administration interface exposes /goform/* endpoints implemented as compiled CGI-style handlers in the device firmware. The vulnerable formsetPPPoE handler parses POST-submitted PPPoE configuration fields and copies the pppUserName argument into a fixed-size stack buffer without bounds validation, producing the CWE-120 classic buffer copy without checking size of input condition. On embedded MIPS/ARM SOHO routers of this class, such overflows typically overwrite the saved return address and can be steered to control the program counter, since these devices generally lack modern mitigations like ASLR, stack canaries, or non-executable stacks. The CPE cpe:2.3:a:edimax:br-6675nd:*:*:*:*:*:*:*:* indicates the entire BR-6675nD product line is in scope, though only version 1.12 firmware is explicitly confirmed by VulDB and EUVD.
RemediationAI
No vendor-released patch identified at time of analysis, as the vendor did not respond to the VulDB disclosure attempt. Because the BR-6675nD is a legacy SOHO router, the highest-assurance remediation is to replace the device with a currently supported model; if replacement is not immediately feasible, restrict the web administration interface to a trusted management VLAN and explicitly disable remote (WAN-side) administration, change the default admin credentials, and place the device behind a firewall ACL that blocks inbound HTTP/HTTPS to the LAN-side management IP from untrusted segments. As a targeted compensating control, avoid using or reconfiguring the PPPoE settings page on untrusted networks since exploitation requires reaching /goform/formsetPPPoE with a valid authenticated session - the trade-off is that legitimate PPPoE WAN reconfiguration must then be performed from a hardened admin host. Monitor VulDB https://vuldb.com/vuln/365380 and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-9399 for any future firmware update.
Stack/heap buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows authenticated remote attackers to corrupt
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router's web management interface allows remote attackers with low
Stack buffer overflow in the Edimax BR-6675nD 1.12 router's PPTP setup handler allows remote authenticated attackers to
Buffer overflow in the Edimax BR-6675nD 1.12 wireless router allows remote attackers to corrupt memory by sending a mali
Stack/heap buffer overflow in Edimax BR-6675nD 1.12 routers allows authenticated remote attackers to corrupt memory via
Command injection in the Edimax BR-6675nD 1.12 router's WPS start handler allows remote attackers with low-privilege aut
Command injection in the Edimax BR-6675nD firmware 1.12 exposes the POST handler at /goform/formHwSet to OS-level comman
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows a low-privileged remote attacker
Command injection in Edimax BR-6675nD 1.12 router firmware allows authenticated remote attackers to execute arbitrary OS
Command injection in the Edimax BR-6675nD 1.12 router's web management interface allows remote authenticated attackers t
Command injection in Edimax BR-6675nD firmware 1.12 enables remote attackers with administrative credentials to execute
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today