EUVD-2026-33469
GHSA-27vr-q2hh-fjhh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level credentials to corrupt memory by sending an oversized selSSID parameter to the /goform/formQoS endpoint. Publicly available exploit code exists per VulDB, raising the practical risk despite the CVSS 4.0 base score of 7.4, though there is no public exploit identified at time of analysis in CISA KEV. The flaw threatens the confidentiality, integrity, and availability of affected SOHO routers and could lead to arbitrary code execution or device takeover.
Technical ContextAI
The vulnerability lies in the formQoS handler within the router's embedded HTTP/CGI-like POST request processor, which parses Quality-of-Service configuration forms. The selSSID parameter is copied into a fixed-size stack or heap buffer without proper bounds checking, the classic CWE-120 'Classic Buffer Overflow' pattern. Edimax BR-6478AC is a consumer/SOHO AC1200 dual-band wireless router (CPE cpe:2.3:a:edimax:br-6478ac:*) running embedded Linux with a goform-based web administration interface - a common architecture in Realtek/Mediatek SDK-derived firmware where input validation across CGI endpoints has historically been weak. Successful overflow on such MIPS/ARM embedded targets typically permits hijacking control flow of the httpd process, which usually runs as root on these devices.
RemediationAI
No vendor-released patch identified at time of analysis - the provided references include only VulDB tracking entries and an exploit write-up, with no Edimax firmware update URL. Owners should monitor https://www.edimax.com/ for a firmware release addressing formQoS input validation and apply it immediately when available. As compensating controls, disable WAN-side access to the router's web administration interface (eliminates remote exploitation at the cost of losing remote management), restrict LAN access to the admin UI via firewall rules or a management VLAN so only trusted hosts can reach /goform/* (reduces internal pivot risk but complicates legitimate admin), enforce a strong unique admin password since exploitation requires PR:L authentication (mitigates opportunistic abuse but not credential-compromise scenarios), and consider replacing end-of-life Edimax BR-6478AC units if no patch is forthcoming, as consumer routers from this generation often receive limited security maintenance.
Stack-based buffer overflow in the Edimax BR-6478AC 1.23 wireless router enables authenticated remote attackers to corru
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Command injection in Edimax BR-6478AC firmware 1.23 allows a remotely authenticated attacker to execute arbitrary OS com
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today