Edimax BR-6478AC V2 EUVD-2026-38192

Attacker must be able to reach the router's HTTP management interface (LAN-side by default, or WAN-side only if remote administration is enabled) and must possess valid web-UI credentials, since the CVSS vector specifies PR:L; exploitation does not require user interaction (UI:N) or unusual attack requirements (AT:N). The specific trigger is a POST request to /goform/formWlSiteSurvey containing an oversized selSSID argument, processed by the formWlSiteSurvey function on Edimax BR-6478AC V2 firmware 1.23. Limiting factors: the device is a consumer router rarely exposed directly to the internet unless remote admin is enabled, and authentication - though often weak - is still required, so opportunistic internet-wide exploitation is constrained relative to a fully unauthenticated bug.

Real-world risk is moderate-to-elevated but bounded by deployment context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) confirms network-reachable, low-complexity exploitation with high impact to confidentiality, integrity, and availability, but PR:L means the attacker must hold at least valid web-UI credentials - frequently the default admin password on consumer routers, which weakens that gate substantially in practice. Publicly available exploit code exists (linked Notion writeup), increasing weaponization likelihood, yet there is no CISA KEV listing and no EPSS score provided in the input, so widespread automated exploitation is not confirmed. The vendor's non-response means no patched firmware is expected, so any internet-exposed BR-6478AC V2 should be treated as a durable risk rather than a transient one. Note: the CVSS vector specifies PR:L (authenticated), so claims of fully unauthenticated RCE should be verified against the exploit writeup before prioritization.

An attacker who has obtained valid web-UI credentials - for example by guessing the default Edimax admin password on an internet-exposed router or by pivoting from a compromised LAN host - sends a crafted POST request to /goform/formWlSiteSurvey with an over-long selSSID value. The oversize copy corrupts memory in the httpd process and, leveraging the publicly disclosed exploit writeup hosted on Notion, can be steered toward arbitrary code execution as root on the router, granting persistent control of the gateway and the ability to intercept or redirect all client traffic.