CVE-2026-10163: Edimax BR-6478AC POST Request formUSBAccount buffer overflow
A vulnerability has been found in Edimax BR-6478AC 1.23. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. The manipulation of the argument UserName/Password leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the USB account functionality or disable handling of /goform/formUSBAccount in the device's administration interface or firmware configuration. If there is no explicit option for the endpoint, disable related USB sharing/account features to prevent POST requests from reaching formUSBAccount.
Edimax BR-6478AC (web management / POST handler) formUSBAccount POST handler / USB account feature = disabled - Compensating control
Block or filter access to the /goform/formUSBAccount endpoint (POST) at the network edge or with a WAF/firewall/ACL. Restrict access to the router management interface to trusted IPs only and deny remote access where not required.
- Operational
Assume exposure if the device was reachable from untrusted networks (an exploit is public). Rotate all administrative and user credentials for the device, monitor logs for signs of exploitation, and apply vendor firmware updates as soon as a fix is released. Devices running version 1.23 are affected; prioritize those for these actions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10163?
The severity of CVE-2026-10163 is classified as high with a score of 8.8.
How do I fix CVE-2026-10163?
To fix CVE-2026-10163, update the firmware of the Edimax BR-6478AC to the latest version that addresses this buffer overflow vulnerability.
What type of vulnerability is CVE-2026-10163?
CVE-2026-10163 is a buffer overflow vulnerability in the POST Request handler of the Edimax BR-6478AC.
Can CVE-2026-10163 be exploited remotely?
Yes, CVE-2026-10163 can be exploited remotely due to the nature of the vulnerability.
What components are affected by CVE-2026-10163?
CVE-2026-10163 affects the function formUSBAccount in the POST Request Handler of the Edimax BR-6478AC.