CVE-2026-10126: Edimax BR-6478AC POST Request formQoS buffer overflow

Synopsis

A stack-based buffer overflow exists in the formQoS handler of the Edimax BR-6478AC router (firmware 1.23), reachable through a crafted POST request to /goform/formQoS where the selSSID parameter is not bounds-checked. The bug is reachable over the network and requires only a low-privileged account on the device's web interface; successful exploitation lets an attacker corrupt memory to read sensitive configuration, alter device settings, or crash the router. No upstream fix has been published, so HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the router's HTTP management interface over the network to deliver the malicious POST request.

• AuthenticationRequired

  A low-privileged account on the device is sufficient to invoke the vulnerable formQoS handler.

• Victim interactionNot required

  No user action is needed; the attacker triggers the overflow directly by sending the crafted request.

• Attack complexityDetail

  Attack complexity is low and a public exploit has been released, making the technique reliable and condition-free.

Blast Radius

• Reads sensitive router configuration including stored Wi-Fi credentials and administrative secrets.
• Modifies device settings such as routing, DNS, and QoS rules to pivot or intercept traffic.
• Crashes or hangs the router, disrupting connectivity for everything behind it.
• Provides a foothold for further code execution on the embedded device given the memory-corruption primitive.