PatchSiren cyber security CVE debrief
CVE-2026-9443 Edimax CVE debrief
A buffer overflow vulnerability exists in the Edimax BR-6478AC router firmware version 1.23. The flaw resides in the formL2TPSetup function within the /goform/formL2TPSetup endpoint, where improper handling of the L2TPUserName parameter in POST requests allows remote attackers to trigger memory corruption. The vulnerability is remotely exploitable without authentication requirements, with public exploit disclosure increasing immediate risk. The vendor was notified prior to disclosure but did not respond.
- Vendor
- Edimax
- Product
- BR-6478AC
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Network administrators managing Edimax BR-6478AC deployments; security teams responsible for edge router infrastructure; organizations with remote access VPN configurations using L2TP
Technical summary
The formL2TPSetup function in Edimax BR-6478AC firmware 1.23 fails to properly validate the length of the L2TPUserName parameter in POST requests to /goform/formL2TPSetup. This buffer overflow condition enables remote attackers to corrupt memory and potentially execute arbitrary code. The attack requires no authentication and can be conducted over the network. Public exploit availability and vendor non-response elevate defensive urgency.
Defensive priority
HIGH
Recommended defensive actions
- Block or restrict access to /goform/formL2TPSetup endpoint at network perimeter
- Implement network segmentation to isolate affected router management interfaces
- Monitor for anomalous POST requests to L2TP configuration endpoints containing oversized L2TPUserName parameters
- Apply firmware updates from Edimax when available; consider replacement if vendor remains unresponsive
- Review and disable remote administration features if not strictly required
Evidence notes
Vulnerability confirmed through VulDB submission (818452) and analysis record (365424). Technical details published via Notion documentation. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability. CWE-119 and CWE-120 (buffer overflow conditions) identified as root cause categories.
Official resources
Public exploit available; vendor unresponsive