CVE-2026-9382
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A buffer overflow vulnerability was found in Edimax BR-6675nD version 1.12 in the formPPTPSetup function of /goform/formPPTPSetup. Manipulation of the pptpUserName argument leads to buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor did not respond.
Risk Assessment
A remote attacker can crash the router or potentially gain control, leading to network compromise.
Recommendation
Block remote access to the router's management interface. Consider replacing the device with a supported model, as the vendor has not released a patch.
Other vulnerabilities in Edimax BR-6675nD
See all- CVE-2026-9439Medium
A vulnerability in Edimax BR-6675nD 1.12. The stainfo function in /goform/stainfo allows command injection via the interface argument. Remote attack, exploit public.
- CVE-2026-9423Medium
In the Edimax BR-6675nD router version 1.12, the mp function in the POST Request Handler component in file /goform/mp is vulnerable to command injection via the command argument. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-9403High
Edimax BR-6675nD version 1.12 is vulnerable to a buffer overflow in the formWlSiteSurvey function of the /goform/formWlSiteSurvey file in the POST Request Handler component. Manipulation of the selSSID argument causes the overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9402Medium
A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWlanMP function of the /goform/formWlanMP file. The attack can be launched remotely by manipulating multiple arguments.
- CVE-2026-9401High
Edimax BR-6675nD version 1.12 is vulnerable to a buffer overflow in the formWanTcpipSetup function of the /goform/formWanTcpipSetup file in the POST Request Handler component. Manipulation of the pppUserName argument causes the overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9400Medium
A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formUSBStorage function of the /goform/formUSBStorage file. The attack can be launched remotely by manipulating the sub_dir argument.
- CVE-2026-9399High
Edimax BR-6675nD version 1.12 is vulnerable to a buffer overflow in the formsetPPPoE function of the /goform/formsetPPPoE file in the POST Request Handler component. Manipulation of the pppUserName argument causes the overflow. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-9381High
A buffer overflow vulnerability was detected in Edimax BR-6675nD router version 1.12 in the formPPPoESetup function of /goform/formPPPoESetup. The attack can be launched remotely and the exploit is public.
- CVE-2026-9380High
A buffer overflow vulnerability was detected in Edimax BR-6675nD router version 1.12 in the formL2TPSetup function of /goform/formL2TPSetup. The attack can be launched remotely and the exploit is public.
- CVE-2026-9379Medium
A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWpsStart function of the /goform/formWpsStart file. The attack can be launched remotely by manipulating the pinCode argument.
Original NVD description (English source)
A flaw has been found in Edimax BR-6675nD 1.12. Affected by this issue is the function formPPTPSetup of the file /goform/formPPTPSetup of the component POST Request Handler. Executing a manipulation of the argument pptpUserName can lead to buffer overflow. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.