CVE-2026-9399: Edimax BR-6675nD POST Request formsetPPPoE buffer overflow
A vulnerability was detected in Edimax BR-6675nD 1.12. This vulnerability affects the function formsetPPPoE of the file /goform/formsetPPPoE of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/ WAN management (HTTP/HTTPS/administration) on the device so the POST handler cannot be invoked remotely.
Edimax BR-6675nD web management remote_management = disabled - Configuration
If PPPoE is not required, disable PPPoE functionality to avoid invoking the vulnerable formsetPPPoE handler (/goform/formsetPPPoE).
Edimax BR-6675nD PPPoE pppoe_enabled = disabled - Configuration
Block or drop HTTP POST requests to the path /goform/formsetPPPoE at the network edge or via a WAF to prevent exploit attempts against the POST handler.
Edge firewall / WAF block_url = /goform/formsetPPPoE - Compensating control
Restrict access to the device management interfaces to trusted IP addresses or a management VLAN and block access from untrusted networks (including the WAN).
- Compensating control
Deploy a WAF/IPS rule to drop requests containing the pppUserName parameter or requests with anomalously long pppUserName values to mitigate buffer-overflow attempts against formsetPPPoE.
- Operational
Monitor device logs and network traffic for exploit attempts; if compromise is suspected, isolate the device, perform a factory reset or replace the device, and rotate any management credentials. Apply vendor-supplied firmware updates when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9399?
The severity of CVE-2026-9399 is high, with a score of 8.8 on the CVSS scale.
How do I fix CVE-2026-9399?
To fix CVE-2026-9399, update the Edimax BR-6675nD to the latest firmware version that addresses this vulnerability.
What components are affected by CVE-2026-9399?
CVE-2026-9399 affects the POST Request Handler in the Edimax BR-6675nD, specifically the formsetPPPoE function.
What type of vulnerability is CVE-2026-9399?
CVE-2026-9399 is classified as a buffer overflow vulnerability.
What can an attacker achieve with CVE-2026-9399?
An attacker can exploit CVE-2026-9399 to execute arbitrary code by manipulating the pppUserName argument.