CVE-2026-10165: Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
A vulnerability was identified in Edimax BR-6478AC 1.23. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote management/administration on the device to prevent remote attackers from invoking the /goform/formWanTcpipSetup POST handler.
Edimax BR-6478AC remote_management = disabled - Compensating control
Restrict access to the router management interface from the WAN: block or limit TCP/HTTP(S) access to the device from untrusted networks and allow only trusted IPs via firewall/ACL.
- Compensating control
Deploy a Web Application Firewall or intrusion prevention rule to block or inspect POST requests targeting /goform/formWanTcpipSetup (and specifically the pppUserName parameter) to mitigate exploitation attempts.
- Operational
Isolate affected devices from untrusted networks until a vendor-supplied firmware update is available and applied; monitor vendor advisories and apply the firmware update as soon as it is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10165?
CVE-2026-10165 has a high severity rating of 8.8.
How do I fix CVE-2026-10165?
To fix CVE-2026-10165, update the Edimax BR-6478AC firmware to the latest version provided by Edimax.
What kind of vulnerability is CVE-2026-10165?
CVE-2026-10165 is a stack-based buffer overflow vulnerability.
What component is affected by CVE-2026-10165?
The affected component in CVE-2026-10165 is the POST Request Handler in the function formWanTcpipSetup.
What can attackers potentially achieve with CVE-2026-10165?
Attackers exploiting CVE-2026-10165 can potentially execute arbitrary code due to the stack-based overflow.