CVE-2026-9381: Edimax BR-6675nD POST Request formPPPoESetup buffer overflow
A vulnerability was detected in Edimax BR-6675nD 1.12. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax BR-6675nDfrom your environment.If the device cannot be patched or reliably isolated, remove it from the network (power off or replace with a non-affected device) until a vendor fix is available.
- Compensating control
Block remote (WAN) access to the device's management interface and restrict management access to trusted IPs at the network firewall or ACLs, since the vulnerability can be exploited remotely.
- Compensating control
Configure a WAF/HTTP filter or reverse proxy to block or drop HTTP POST requests targeting the path /goform/formPPPoESetup (the formPPPoESetup handler) to prevent exploitation of the buffer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9381?
The severity of CVE-2026-9381 is high with a CVSS score of 8.8.
How do I fix CVE-2026-9381?
To fix CVE-2026-9381, update the Edimax BR-6675nD firmware to the latest version provided by the manufacturer.
What causes the vulnerability in CVE-2026-9381?
CVE-2026-9381 is caused by a buffer overflow vulnerability in the formPPPoESetup function due to improper handling of the pppUserName argument.
What type of attack can exploit CVE-2026-9381?
CVE-2026-9381 can be exploited through a manipulated buffer overflow attack affecting the Edimax BR-6675nD router.
Is CVE-2026-9381 a remote or local vulnerability?
CVE-2026-9381 is a remote vulnerability that can be exploited over the network.