EUVD-2026-31653
GHSA-vrwj-7pfm-fv87
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. Executing a manipulation of the argument selSSID can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remote attackers to corrupt memory by submitting an oversized selSSID parameter to /goform/formiNICSiteSurvey, with publicly available exploit code exists and no vendor response to coordinated disclosure. The flaw affects the formiNICSiteSurvey POST request handler and yields high impact on confidentiality, integrity, and availability of the device. EPSS is low (0.04%, 13th percentile), indicating limited mass-scanning activity despite the published exploit.
Technical ContextAI
The Edimax BR-6478AC is a consumer/SOHO AC1200 dual-band wireless router whose web administration interface uses 'goform' CGI-style handlers, a pattern common on Realtek/Ralink-based embedded Linux router firmware. The vulnerable handler formiNICSiteSurvey parses the selSSID POST parameter without proper length validation, which is the classic CWE-120 (Classic Buffer Copy Without Checking Size of Input) root cause - typically caused by use of unsafe routines such as strcpy/sprintf into fixed stack buffers. Given the embedded MIPS/ARM context typical of these devices, exploitation generally targets stack frames lacking modern mitigations (no ASLR/NX on many vendor builds), making memory corruption an avenue toward code execution or denial of service on the router itself. The CPE cpe:2.3:a:edimax:br-6478ac confirms the scope is restricted to this specific Edimax BR-6478AC model.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure per the VulDB report, so users of BR-6478AC firmware 1.23 should assume the issue is unpatched and apply compensating controls. Restrict access to the web administration interface to trusted management VLANs or specific source IPs, disable any remote/WAN-side administration option (a common Edimax setting), and change default administrative credentials to long unique passwords to raise the bar against the PR:L precondition. Where feasible, replace the device with a supported router model, since the vendor's lack of response suggests no forthcoming fix; the trade-off of network-segmentation controls is that legitimate remote management becomes harder, and credential rotation alone does not eliminate the underlying memory-corruption flaw if an attacker is already on the LAN. Monitor https://vuldb.com/vuln/365423 and Edimax's support site for any belated firmware release.
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corru
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today