CVE-2026-9443: Edimax BR-6478AC POST Request formL2TPSetup buffer overflow
A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the L2TP/L2TP server feature in the device configuration so the vulnerable /goform/formL2TPSetup handler is not reachable.
Edimax BR-6478AC firmware 1.23 L2TP (formL2TPSetup POST handler) = disabled - Compensating control
Block access to the vulnerable endpoint and management interface at the network perimeter: create firewall/WAF rules to block HTTP(S) POST requests to /goform/formL2TPSetup, and restrict access to the device's web management ports to trusted IPs only. If possible, isolate the device from the Internet until mitigations or a vendor patch are available.
- Operational
Monitor device and perimeter logs for attempts targeting /goform/formL2TPSetup, isolate any devices showing indicators of compromise, and replace or decommission affected hardware if no vendor patch/response becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9443?
The severity of CVE-2026-9443 is high, rated at 8.8.
How do I fix CVE-2026-9443?
To fix CVE-2026-9443, update the Edimax BR-6478AC firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-9443?
CVE-2026-9443 is a buffer overflow vulnerability.
What component is affected by CVE-2026-9443?
CVE-2026-9443 affects the POST Request Handler, specifically the formL2TPSetup function.
What could happen if CVE-2026-9443 is exploited?
Exploitation of CVE-2026-9443 could allow an attacker to remotely execute code due to the buffer overflow.