CVE-2026-8775: Edimax BR-6428NS POST Request formL2TPSetup buffer overflow
A flaw has been found in Edimax BR-6428NS 1.10. This affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. This manipulation of the argument L2TPUserName causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote (WAN) access to the web management interface so the POST endpoint /goform/formL2TPSetup cannot be invoked from untrusted networks.
Edimax BR-6428NS web administration remote_web_management = disabled - Configuration
Disable the L2TP service (or disable L2TP server and any remote L2TP configuration via the web UI) if L2TP is not required to eliminate exposure of the vulnerable formL2TPSetup handler.
Edimax BR-6428NS L2TP service L2TP service / L2TPUserName handling = disabled - Compensating control
Restrict access to the device management interfaces from untrusted networks (e.g., firewall rules or ACLs that allow only trusted IP addresses, and block WAN-to-device HTTP/HTTPS access). If possible, place the device management interface on an isolated management network.
- Operational
Monitor device logs and network traffic for attempts to access /goform/formL2TPSetup or other suspicious POST requests. If exploitation is suspected, isolate the device from the network for investigation.
- Operational
If compromise is suspected, perform recovery actions such as factory reset or reflash firmware and rotate all device and administrator credentials.
- Operational
Apply any vendor-supplied firmware update or advisory addressing this issue as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8775?
CVE-2026-8775 is classified as a high severity vulnerability due to the potential for arbitrary code execution through a buffer overflow.
How do I fix CVE-2026-8775?
To fix CVE-2026-8775, update the Edimax BR-6428NS to the latest firmware version that addresses this vulnerability.
What products are affected by CVE-2026-8775?
CVE-2026-8775 affects the Edimax BR-6428NS router specifically in version 1.10.
Can CVE-2026-8775 lead to unauthorized access?
Yes, CVE-2026-8775 can potentially lead to unauthorized access if exploited, as it involves a buffer overflow vulnerability.
What is the nature of the vulnerability in CVE-2026-8775?
CVE-2026-8775 is a buffer overflow vulnerability that arises from improper handling of the L2TPUserName parameter during POST requests.