CVE-2026-8776: Edimax BR-6428NS POST Request formPPTPSetup buffer overflow
A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Such manipulation of the argument pptpUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the PPTP server/PPTP VPN functionality on the router to prevent processing of /goform/formPPTPSetup and exploitation of the pptpUserName buffer overflow.
Edimax BR-6428NS (PPTP) pptp server = disabled - Configuration
Disable remote (WAN) web management or restrict web management access to specific trusted IP addresses to prevent remote HTTP POST access to /goform/formPPTPSetup.
Edimax BR-6428NS (web management) remote_management = disabled or restricted to trusted IPs - Compensating control
At the network perimeter or inline gateway, block or filter HTTP POST requests targeting /goform/formPPTPSetup and/or block access to the router's web management ports from untrusted networks.
- Compensating control
Block PPTP traffic at the perimeter (e.g., TCP port 1723 and GRE protocol 47) to prevent PPTP-related connections that could trigger the vulnerability.
- Operational
Monitor for public exploit activity targeting this disclosure and review device logs for signs of exploitation; if compromise is suspected, isolate the device from the network.
- Operational
Rotate administrative and VPN credentials (change passwords and keys) if the device may have been exposed or compromised.
- Operational
Watch the vendor for official firmware updates addressing this issue and apply vendor-supplied firmware when available; if no fix is provided, consider replacing the affected device with a model that is actively supported.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8776?
CVE-2026-8776 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-8776?
To fix CVE-2026-8776, update the Edimax BR-6428NS router to version 1.11 or newer.
What systems are affected by CVE-2026-8776?
CVE-2026-8776 affects Edimax BR-6428NS routers running version 1.10.
What is the nature of CVE-2026-8776?
CVE-2026-8776 is a buffer overflow vulnerability in the formPPTPSetup function accessed via POST requests.
Can CVE-2026-8776 be exploited remotely?
Yes, CVE-2026-8776 can be exploited remotely, allowing an attacker to compromise the device.