EUVD-2026-33484
GHSA-rfrj-7c7m-jchq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router admin web interface
-
DeliveryAuthenticate with admin credentials
-
ExploitPOST to /goform/formUSBFolder with oversized ShareName/SelectName
-
ExecutionOverflow buffer in formUSBFolder handler
-
PersistCorrupt memory in web daemon
-
ImpactAchieve DoS or code execution on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the router's HTTP administration interface on the LAN or, if remote management is enabled, the WAN; (2) valid administrator-level credentials to the web UI (PR:L in the CVSS vector); and (3) the ability to issue a POST to the /goform/formUSBFolder endpoint with attacker-controlled ShareName or SelectName parameters, which presupposes the USB sharing feature is present and reachable in the firmware build (confirmed on BR-6478AC 1.23, specifically demonstrated on the BR-6478ACV2 hardware revision). Limiting factors: the attacker must already authenticate to the admin panel, the admin interface is LAN-only in default configurations, and the vulnerability is scoped to this Edimax model/firmware rather than a broad product line. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H gives 7.4 (High): exploitable over the network with low complexity and no user interaction, but requiring low privileges (an authenticated session on the web UI). The E:P threat metric and the public Notion exploit writeup confirm 'publicly available exploit code exists.' There is no CISA KEV entry and no EPSS score was supplied in the source material, so widespread opportunistic exploitation cannot be asserted; risk is concentrated where the admin interface is reachable from untrusted networks or where default/weak admin credentials are in use - both common conditions for this class of SOHO router. The PR:L requirement materially lowers risk versus an unauthenticated equivalent, but credential reuse, default passwords, and CSRF-style chaining against logged-in admins keep the practical exposure meaningful, especially given the lack of an identified vendor patch. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed administrator credentials (or who chains a CSRF against a logged-in admin) sends a crafted POST request to /goform/formUSBFolder with an oversized ShareName or SelectName value, overflowing the parameter buffer in the web daemon. Because publicly available exploit code exists on the referenced Notion page, the barrier to weaponization is low, and successful memory corruption on this embedded Linux router typically yields denial of service of the admin daemon at minimum and plausibly code execution as the web service user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 31, 2026
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory via the formUSBFolder POST handler by supplying oversized ShareName or SelectName arguments. Publicly available exploit code exists (hosted on a Notion page referenced by VulDB), and the CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact on the device with low privileges required. No CISA KEV listing, so this is best treated as a publicly weaponizable bug awaiting a vendor response.
Earlier versions of this analysis (2)
Remote buffer overflow in the Edimax BR-6478AC 1.23 wireless router allows authenticated attackers to corrupt memory through the formUSBFolder POST handler by supplying oversized ShareName or SelectName arguments. Publicly available exploit code exists (published via a Notion writeup) and the issue was disclosed by VulDB, raising the likelihood of opportunistic abuse against exposed administrative interfaces. CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact, though exploitation requires low-privilege authentication to the device.
Remote buffer overflow in the Edimax BR-6478AC wireless router (firmware 1.23) allows authenticated attackers to corrupt memory via the formUSBFolder handler reachable at /goform/formUSBFolder, by supplying oversized ShareName or SelectName POST parameters. Publicly available exploit code exists (published via a Notion writeup linked from VulDB), and successful exploitation can lead to denial of service or arbitrary code execution on the device. No CISA KEV listing or EPSS score was provided in the source data, so widespread active exploitation has not been confirmed at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis, so administrators should apply compensating controls until Edimax publishes updated firmware: restrict access to the router's web administration interface to trusted management VLANs or LAN-only (disable any 'remote management' / WAN-side admin option), which eliminates the network attack surface at the cost of needing on-network access for changes; change default administrator credentials and enforce strong unique passwords to raise the bar for the PR:L precondition; disable the USB sharing feature entirely if not in use, which removes the vulnerable formUSBFolder code path at the cost of losing network USB share functionality; and consider replacing the device if it is end-of-life. Monitor the Edimax support site and the VulDB entry at https://vuldb.com/vuln/367417 for an official fix, and subscribe to vendor security notifications so the patch can be applied as soon as it is released.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax BR-6478AC is a consumer/SOHO 802.11ac wireless router whose web-administration interface exposes /goform/* endpoints implemented by a CGI-like handler embedded in the device firmware. The vulnerable formUSBFolder function processes POST parameters tied to USB share configuration (ShareName and SelectName) and copies attacker-supplied input into a fixed-size stack/heap buffer without proper length validation, which is the classic CWE-120 (Classic Buffer Overflow / unbounded memcpy/strcpy pattern). Because router firmware of this class is typically a MIPS or ARM ELF with no/limited ASLR, partial NX, and no stack canaries, a controlled overflow in such a handler is a strong primitive for memory corruption and potential code execution as the web daemon (usually root on embedded Linux). The affected component is identified by CPE cpe:2.3:a:edimax:br-6478ac:*:*:*:*:*:*:*:* with the BR-6478ACV2 hardware revision explicitly named in the public PoC writeup.
Know when Br 6478Ac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Edimax BR-6478AC 1.23. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. The manipulation of the argument ShareName/SelectName results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Executive ViewAI
The Edimax BR-6478AC wireless router (version 1.23) contains a remote buffer overflow vulnerability allowing authenticated attackers to corrupt device memory with publicly available exploit code. Organizations using this router model face risks of network compromise, traffic interception, and service disruption. Immediate inventory assessment and administrative access controls are required pending vendor patch availability.
Restrict router administrative interface access to trusted IP addresses via network firewall ACLs. Implement network segmentation to isolate router management traffic from general network. Enable and monitor administrative access logging for all authentication attempts. Disable USB functionality on affected devices if not operationally required. Escalate to Edimax support for patch status; plan device replacement with alternative router models if vendor patch timeline exceeds 90 days.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Edimax BR-6478AC Buffer Overflow and Injection Flaws
View all 4Buffer overflow in the Edimax BR-6478AC 1.23 router's web management interface allows remote attackers with low-level cr
Remote buffer overflow in the Edimax BR-6478AC router (firmware 1.23) allows authenticated attackers to corrupt memory b
Stack/buffer overflow in the Edimax BR-6478AC 1.23 wireless router's web management interface allows authenticated remot
Authenticated command injection in Edimax BR-6478AC 1.23 firmware allows network-adjacent attackers with low-privilege c
Command injection in Edimax BR-6478AC 1.23 exposes the router's web management interface to remote exploitation via a cr
Command injection in the Edimax BR-6478AC 1.23 wireless router's formAccept POST handler allows an authenticated remote
Exploit-DB