CVE-2026-10125: Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow

Synopsis

A stack-based buffer overflow exists in the formPPPoESetup handler of the Edimax BR-6478AC router (version 1.23), reachable through a POST request to /goform/formPPPoESetup. An authenticated attacker with any low-privilege account on the device's web interface can send an oversized pppUserName parameter over the network to overflow the stack, enabling arbitrary code execution, configuration tampering, or device crash. No vendor fix has been published; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network to deliver the malicious POST.

• AuthenticationRequired

  A low-privilege account on the device is needed (PR:L), but any authenticated user session is sufficient.

• Victim interactionNot required

  No user has to click or interact - the attacker drives the exploit directly against the endpoint.

• Attack complexityDetail

  Attack complexity is low and a public exploit exists, making the bug reliable to trigger without environmental tuning.

Blast Radius

• Executes attacker-controlled code on the router with the privileges of the web service, typically root on this device class.
• Reads and modifies persisted device configuration, including PPPoE credentials, DNS settings, and admin secrets.
• Disrupts or crashes the router, taking the network segment behind it offline.
• Provides a pivot point on the network edge for further lateral movement into the LAN.