CVE-2026-10164: Edimax BR-6478AC POST Request formUSBFolder buffer overflow
A vulnerability was found in Edimax BR-6478AC 1.23. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. The manipulation of the argument ShareName/SelectName results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the device UI/firmware allows, disable USB folder sharing or the formUSBFolder POST handler. If no configuration option exists, physically remove or unplug any attached USB storage to prevent access to the vulnerable endpoint.
Edimax BR-6478AC POST Request Handler (/goform/formUSBFolder) USB folder sharing / formUSBFolder POST handler = disabled / unplug USB storage - Compensating control
Restrict and harden network access to the device: block or filter requests to /goform/formUSBFolder and the device management interface using firewall rules, ACLs or a WAF; allow management only from trusted IPs and/or isolate the device from untrusted networks.
- Operational
Enable logging and monitoring for POST requests to /goform/formUSBFolder and related anomalous activity, investigate any suspicious events, and apply any vendor firmware updates or patches addressing this issue as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10164?
The severity of CVE-2026-10164 is high, rated at 8.8.
What type of vulnerability is CVE-2026-10164?
CVE-2026-10164 is classified as a buffer overflow vulnerability.
How do I fix CVE-2026-10164?
To fix CVE-2026-10164, it is recommended to update the Edimax BR-6478AC firmware to the latest version that addresses this issue.
Can CVE-2026-10164 be exploited remotely?
Yes, CVE-2026-10164 can be exploited remotely due to its nature of allowing remote POST requests.
What components are affected by CVE-2026-10164?
CVE-2026-10164 affects the formUSBFolder function within the POST Request Handler of the Edimax BR-6478AC.