Edimax BR-6478AC Vulnerability: Remote Stack Buffer Overflow (CVE-2026-10165)
The National Vulnerability Database has detailed CVE-2026-10165, a high-severity stack-based buffer overflow affecting Edimax BR-6478AC routers, specifically version 1.23. The vulnerability resides in the formWanTcpipSetup function within the /goform/formWanTcpipSetup file, triggered by manipulating the pppUserName argument in a POST request. This flaw allows for remote exploitation.
Rated with a CVSS v3.1 score of 8.8 (High), this vulnerability poses a significant risk. The attack vector is network-based with low privileges required and no user interaction, making it highly attractive to attackers. Crucially, an exploit for this vulnerability is publicly available, meaning active exploitation is not just theoretical but imminent.
For defenders, this is a critical alert. Routers are prime targets for initial access and persistence in home and small office networks. An attacker gaining control of a router can redirect traffic, establish VPNs for further attacks, or use it as a pivot point into the internal network. Given the public exploit, patching or replacing affected devices is paramount before adversaries leverage this widespread access vector.
What This Means For You
- If your organization or remote workforce uses Edimax BR-6478AC 1.23 routers, you are directly exposed. This isn't theoretical; a public exploit exists. Immediately verify your router firmware versions. If you cannot patch to a secure version, replace these devices with supported hardware. Assume any unpatched device is already compromised and investigate network logs for unusual activity originating from these devices.
Related ATT&CK Techniques
🛡️ Detection Rules
5 rules · 6 SIEM formats5 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
Web Application Exploitation Attempt — CVE-2026-10165
title: Web Application Exploitation Attempt — CVE-2026-10165
id: scw-2026-05-31-1
status: experimental
level: high
description: |
Detects common exploitation patterns targeting web applications. Review CVE-2026-10165 advisories for specific indicators.
author: SCW Feed Engine (auto-generated)
date: 2026-05-31
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-10165/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '..'
- 'SELECT'
- 'UNION'
- '<script'
- 'cmd='
- '/etc/passwd'
condition: selection
falsepositives:
- Legitimate activity from CVE-2026-10165
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-10165 | Buffer Overflow | Edimax BR-6478AC version 1.23 |
| CVE-2026-10165 | Buffer Overflow | Vulnerable function: formWanTcpipSetup |
| CVE-2026-10165 | Buffer Overflow | Vulnerable file: /goform/formWanTcpipSetup |
| CVE-2026-10165 | Buffer Overflow | Vulnerable component: POST Request Handler |
| CVE-2026-10165 | Buffer Overflow | Vulnerable argument: pppUserName |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 31, 2026 at 07:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-48209: OTRS XSS Exposes Agent Sessions to Attackers
CVE-2026-48209 — An improper neutralization of user-controllable input in OTRS or ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected cross-site scripting (XSS)...
CVE-2026-48208 — Denial of Service
CVE-2026-48208 — An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG...
CVE-2026-48189 — OTRS Customer Backend Module Vulnerability
CVE-2026-48189 — An improper Input Validation vulnerability in OTRS Customer Backend module allows to access customer information which are restricted to other groups. Please note...