CVE-2026-9442: Edimax BR-6478AC POST Request formiNICSiteSurvey buffer overflow
A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. Executing a manipulation of the argument selSSID can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
edimax/br-6478acfrom your environment.If continued use is not required or mitigations cannot be applied, remove/decommission or replace the affected Edimax BR-6478AC device.
- Configuration
Disable remote (WAN) web management/remote administration on the device to prevent remote exploitation of the POST handler.
Edimax BR-6478AC web management remote_management = disabled - Compensating control
Block or filter HTTP POST requests to the management endpoint /goform/formiNICSiteSurvey (e.g., via perimeter firewall, WAF or reverse proxy rules) to prevent exploitation of the formiNICSiteSurvey handler.
- Compensating control
Restrict access to the device's management interface to trusted IP addresses only (firewall/ACL) and block management ports from untrusted networks/Internet, since the vulnerability can be exploited remotely.
- Operational
Monitor device logs and network traffic for signs of exploitation of the POST handler; isolate and investigate any suspected compromised devices and rotate credentials if compromise is suspected. Apply any vendor-supplied patch or firmware update if/when it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9442?
The severity of CVE-2026-9442 is high, rated at 8.8.
What vulnerability does CVE-2026-9442 address?
CVE-2026-9442 addresses a buffer overflow vulnerability in the formiNICSiteSurvey function of the Edimax BR-6478AC.
How can CVE-2026-9442 be exploited?
CVE-2026-9442 can be exploited remotely by manipulating the selSSID argument in a POST request.
What is the risk of not addressing CVE-2026-9442?
Not addressing CVE-2026-9442 leaves systems vulnerable to remote code execution due to buffer overflow.
How do I fix CVE-2026-9442?
To fix CVE-2026-9442, update the Edimax BR-6478AC firmware to the latest version that addresses this vulnerability.