EUVD-2026-33482
GHSA-pxj4-7p26-956c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed router admin interface
-
DeliveryAuthenticate with default or weak credentials
-
ExploitSend crafted POST to /goform/formUSBAccount
-
ExecutionOverflow buffer via oversized UserName/Password
-
PersistExecute shellcode as web daemon
-
ImpactInstall persistent implant or botnet agent
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP administration interface on the /goform/formUSBAccount endpoint AND valid low-privilege credentials to the web admin (PR:L in the CVSS 4.0 vector), with no user interaction required (UI:N). The endpoint relates to the device's USB storage account configuration feature, so the router must expose this CGI handler (default on the BR-6478AC firmware 1.23). Limiting factors are the credential requirement (mitigated where defaults are unchanged) and that the admin interface is typically LAN-only unless remote management has been deliberately enabled, which would otherwise make WAN-side exploitation feasible. |
| Impact | The CVSS 4.0 score of 7.4 reflects network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), with high impact to confidentiality, integrity, and availability of the vulnerable component (VC:H/VI:H/VA:H) but no scope change. The E:P (Proof-of-Concept) exploit maturity aligns with the disclosed PoC on the referenced Notion writeup, materially raising real-world risk. There is no EPSS score provided and the CVE is not listed in CISA KEV, suggesting no confirmed active exploitation; however, SOHO routers are frequently targeted by botnets (Mirai-class) once PoCs surface, especially when default or weak admin credentials satisfy the PR:L requirement. The combination of PR:L plus exposure of administrative endpoints to LAN (and sometimes WAN, when remote management is enabled) means the practical attack surface is significant for any device with default or guessable credentials. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege admin credentials (default 'admin/1234', guessed, or harvested from a credential dump) sends a crafted POST request to /goform/formUSBAccount with oversized UserName or Password fields, overflowing a stack buffer in the formUSBAccount handler. On these embedded MIPS/ARM devices with limited mitigations, the overflow can be leveraged to crash the router (denial of service) or to achieve code execution as the web daemon (typically root), enabling persistent implantation, DNS hijacking, or recruitment into a botnet - a published PoC at the referenced Notion page lowers the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Buffer overflow in the Edimax BR-6478AC v1.23 wireless router allows authenticated remote attackers to corrupt memory by sending oversized UserName or Password values to the /goform/formUSBAccount endpoint. Publicly available exploit code exists for this issue, raising the practical risk despite the requirement for low-level credentials, though no active exploitation has been confirmed via CISA KEV.
Earlier versions of this analysis (2)
Buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated remote attackers to corrupt memory by submitting oversized UserName or Password parameters to the /goform/formUSBAccount endpoint. A public exploit write-up has been published on a Notion page referenced by VulDB, raising the practical risk of opportunistic exploitation against exposed management interfaces, though no CISA KEV listing or EPSS data accompanies the advisory.
Stack buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated remote attackers to corrupt memory and likely achieve arbitrary code execution by sending oversized UserName or Password parameters to the /goform/formUSBAccount endpoint. Publicly available exploit code exists (disclosed via VulDB and a Notion writeup), raising the practical risk despite no current CISA KEV listing. The CVSS 3.1 score of 8.8 reflects network reach, low complexity, and full confidentiality, integrity, and availability impact once the low-privilege auth requirement is satisfied.
RemediationAI
No vendor-released patch identified at time of analysis - the Edimax BR-6478AC reached end-of-sale years ago and the VulDB entry (https://vuldb.com/vuln/367416) and exploit writeup do not cite a fixed firmware release. Defenders should disable remote (WAN-side) management of the router web interface to remove internet-exposed attack surface, restrict LAN access to the /goform/formUSBAccount endpoint via segmenting the management network or placing the router behind a firewall that filters HTTP/HTTPS to its administrative IP, and change default admin credentials to long random passwords to make the PR:L precondition harder to satisfy. Where possible, replace the device with a vendor-supported model since unpatched buffer overflows in embedded admin handlers commonly become the entry point for IoT botnets; the side effect of disabling remote management is loss of off-network administration convenience.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the formUSBAccount handler within the router's embedded HTTP administration interface (goform CGI framework), commonly implemented in Realtek/Broadcom SDK-based consumer routers using fixed-size stack buffers for processing form parameters. CWE-120 (Classic Buffer Overflow / 'Buffer Copy without Checking Size of Input') indicates the function copies attacker-controlled UserName and Password POST parameters into undersized buffers without bounds validation, enabling memory corruption that on MIPS/ARM embedded systems can lead to stack smashing, return address overwrite, and potential code execution depending on the presence of mitigations like NX or ASLR (which are typically absent on consumer SOHO routers). The CPE cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* identifies all firmware versions of the BR-6478AC AC1200 dual-band gigabit router as in scope, though the description specifically cites version 1.23.
Know when Br 6478Ac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Edimax BR-6478AC 1.23. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. The manipulation of the argument UserName/Password leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Edimax BR-6478AC wireless routers contain a memory corruption vulnerability with publicly available exploit code that attackers with low-level credentials could leverage to compromise network infrastructure; without a vendor patch, organizations face prolonged exposure requiring immediate compensating controls.
No vendor-released patch identified at time of analysis. Implement compensating controls: (1) Restrict network access to affected routers through firewall rules and network segmentation; (2) Disable USB Account endpoint if operationally unnecessary; (3) Deploy Web Application Firewall rules blocking oversized or malformed inputs to /goform/formUSBAccount; (4) Implement IP whitelisting and role-based access controls limiting low-level account provisioning; (5) Enable comprehensive logging and real-time alerting on management interface access and authentication attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Edimax BR-6478AC Buffer Overflow and Injection Flaws
View all 4Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Exploit-DB