PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9443 Edimax CVE debrief

A buffer overflow vulnerability exists in the Edimax BR-6478AC router firmware version 1.23. The flaw resides in the formL2TPSetup function within the /goform/formL2TPSetup endpoint, where improper handling of the L2TPUserName parameter in POST requests allows remote attackers to trigger memory corruption. The vulnerability is remotely exploitable without authentication requirements, with public exploit disclosure increasing immediate risk. The vendor was notified prior to disclosure but did not respond.

Vendor
Edimax
Product
BR-6478AC
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-25
Original CVE updated
2026-07-23
Advisory published
2026-05-25
Advisory updated
2026-07-23

Who should care

Network administrators managing Edimax BR-6478AC deployments; security teams responsible for edge router infrastructure; organizations with remote access VPN configurations using L2TP

Technical summary

The formL2TPSetup function in Edimax BR-6478AC firmware 1.23 fails to properly validate the length of the L2TPUserName parameter in POST requests to /goform/formL2TPSetup. This buffer overflow condition enables remote attackers to corrupt memory and potentially execute arbitrary code. The attack requires no authentication and can be conducted over the network. Public exploit availability and vendor non-response elevate defensive urgency.

Defensive priority

HIGH

Recommended defensive actions

  • Block or restrict access to /goform/formL2TPSetup endpoint at network perimeter
  • Implement network segmentation to isolate affected router management interfaces
  • Monitor for anomalous POST requests to L2TP configuration endpoints containing oversized L2TPUserName parameters
  • Apply firmware updates from Edimax when available; consider replacement if vendor remains unresponsive
  • Review and disable remote administration features if not strictly required

Evidence notes

Vulnerability confirmed through VulDB submission (818452) and analysis record (365424). Technical details published via Notion documentation. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, and high impact to confidentiality, integrity, and availability. CWE-119 and CWE-120 (buffer overflow conditions) identified as root cause categories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9443 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9443

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9443 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9443

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.