Edimax BR-6478AC EUVD-2026-33485

Attacker requires authenticated access to the router's web management interface (CVSS PR:L) and network reachability to the HTTP admin endpoint /goform/formWanTcpipSetup - typically LAN-side on default deployments, but exploitable from the internet if remote/WAN administration has been enabled. The specific trigger is a crafted POST request setting an over-long pppUserName parameter to the formWanTcpipSetup handler. Limiting factors: the device must be the Edimax BR-6478AC running firmware 1.23 (v2 hardware confirmed in the exploit writeup), the attacker must possess valid web UI credentials of any privilege level, and no end-user interaction is required (UI:N). In practice the authentication barrier is weakened by consumer-router default-credential prevalence.

Risk signals are mixed and require careful weighting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation with full impact on the vulnerable component, but PR:L means the attacker must hold some level of authenticated access to the web UI - a meaningful brake on widespread mass exploitation. Publicly available exploit code exists, which raises the practical threat level, but there is no CISA KEV listing and no EPSS score was provided in the input, so wide-scale opportunistic exploitation is not confirmed. The SSVC technical impact would be 'total' given full VC/VI/VA, automatable likely 'no' due to the auth requirement and embedded-device targeting, and exploitation status 'PoC' per the references. Conflict to note: the description states 'attack may be performed from remote' but PR:L authentication is required - these are not contradictory, but defenders should not interpret 'remote' as 'unauthenticated'. The product is also a consumer router, meaning many deployed devices use default or weak credentials, effectively lowering the auth barrier in practice.

An attacker with low-privilege credentials to the router's web interface - obtained via default credentials, credential stuffing, phishing of the home/office user, or lateral movement from a compromised LAN host - sends a POST request to /goform/formWanTcpipSetup with an over-long pppUserName parameter, overflowing the stack buffer to overwrite the saved return address and pivot execution into attacker-controlled shellcode. Publicly available exploit code lowers the skill barrier; successful exploitation yields code execution as the web daemon (typically root on embedded routers), enabling DNS hijacking, traffic interception, persistent botnet implantation, or pivoting deeper into the LAN.