CVE-2026-10163
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A vulnerability has been found in Edimax BR-6478AC 1.23. The function formUSBAccount of the file /goform/formUSBAccount is affected by buffer overflow via manipulation of the UserName/Password arguments, allowing remote exploitation.
Risk Assessment
An attacker can remotely overflow the buffer and potentially execute arbitrary code, leading to router compromise.
Recommendation
Update the router firmware to the latest version if a patch is available, or consider replacing the device.
Other vulnerabilities in Edimax BR-6478AC
See all- CVE-2026-10166Medium
Edimax BR-6478AC router version 1.23 has a command injection vulnerability in the formWlbasic function. Manipulating the rootAPmac argument allows remote command execution. The exploit is public.
- CVE-2026-10165High
A stack-based buffer overflow was identified in Edimax BR-6478AC version 1.23 in the formWanTcpipSetup function of the /goform/formWanTcpipSetup file. The attack can be launched remotely, and the exploit is publicly available.
- CVE-2026-10164High
A vulnerability was found in Edimax BR-6478AC 1.23. The function formUSBFolder of the file /goform/formUSBFolder is affected by buffer overflow via manipulation of the ShareName/SelectName arguments, allowing remote exploitation.
- CVE-2026-10127Medium
In Edimax BR-6478AC 1.23, the formStaDrvSetup function in /goform/formStaDrvSetup is vulnerable to command injection via the rootAPmac argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-10126High
Buffer overflow in the formQoS function of Edimax BR-6478AC 1.23 allows a remote attacker to execute code by manipulating the selSSID argument.
- CVE-2026-10125High
In Edimax BR-6478AC version 1.23, a stack-based buffer overflow vulnerability was found in the formPPPoESetup function of the /goform/formPPPoESetup file. The attack involves manipulating the pppUserName argument and can be performed remotely. The exploit is publicly available.
- CVE-2026-9443High
Buffer overflow vulnerability in the formL2TPSetup function in /goform/formL2TPSetup on Edimax BR-6478AC 1.23. Manipulating the L2TPUserName argument can lead to buffer overflow.
- CVE-2026-9442High
Buffer overflow vulnerability in the formiNICSiteSurvey function in /goform/formiNICSiteSurvey on Edimax BR-6478AC 1.23. Manipulating the selSSID argument can lead to buffer overflow.
- CVE-2026-9441Medium
A vulnerability in Edimax BR-6478AC 1.23. The formiNICbasic function in /goform/formiNICbasic of the POST Request Handler component allows command injection via the rootAPmac argument. Remote attack, exploit public.
- CVE-2026-9440Medium
A vulnerability in Edimax BR-6478AC 1.23. The formAccept function in /goform/formAccept of the POST Request Handler component allows command injection via the submit-url argument. Remote attack possible, exploit public.
Original NVD description (English source)
A vulnerability has been found in Edimax BR-6478AC 1.23. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. The manipulation of the argument UserName/Password leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.