CVE-2026-10125: Remote Stack Overflow in Edimax Router’s PPPoE Setup Handler

A remotely exploitable stack-based buffer overflow in the Edimax BR-6478AC router lets attackers corrupt memory through its PPPoE configuration handler, and NVD has already deprioritized the record for deeper enrichment due to the device's unsupported status.[nvd.nist]

What Is the Edimax BR-6478AC

The BR-6478AC is a consumer wireless router from Edimax, running firmware version 1.23, offering standard broadband connectivity features including PPPoE-based internet setup common in DSL and fiber connections requiring authenticated dial-in style access.[sentinelone]

The Vulnerability Explained

The flaw resides in the formPPPoESetup function, part of the POST Request Handler component located at /goform/formPPPoESetup. This function processes the pppUserName argument submitted when a user configures PPPoE connection settings on the router.[nvd.nist]

The function fails to validate the length of the pppUserName input before copying it into a fixed-size stack buffer, resulting in a stack-based buffer overflow classified under CWE-121 and the broader CWE-119. This is the same weakness class seen repeatedly across other embedded router firmware disclosures, where user-facing configuration forms accept unbounded string input and copy it directly into memory without validation.[nvd.nist]

Severity and Scoring

Independent assessments converge closely around a high-severity rating, though the exact framework used produces some variation in the final number.

NVD's own severity summary places this at 8.8, High, reflecting a network attack vector, low complexity, and severe impact once exploited. VulDB's CVSS v4.0 assessment scores it somewhat lower at 7.4, High, using the vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, confirming remote exploitability with low privileges and no user interaction required, alongside high impact on confidentiality, integrity, and availability. The vulnerability was published on May 30, 2026, and last modified on June 17, 2026, with a public exploit already disclosed.[sherlockforensics]

How an Attacker Exploits It

An attacker with low-level access to the router's management interface submits an oversized value in the pppUserName parameter to the /goform/formPPPoESetup endpoint. Since the firmware never checks this input against the buffer's actual capacity, the overflow spills into adjacent stack memory, corrupting control-flow data used to determine program execution.[nvd.nist]

A carefully crafted overflow payload could allow the attacker to redirect execution and run arbitrary code with the router's own privileges, consistent with the high confidentiality, integrity, and availability impact reflected across all severity assessments. Because the attack is entirely network-based, any device with its management interface reachable from an untrusted network segment faces a realistic risk of remote exploitation.[sherlockforensics]

Vendor and NVD Status

Red Hat's security team has confirmed this vulnerability does not affect any currently supported Red Hat product, consistent with the pattern seen in other embedded consumer router CVEs where the underlying device sits entirely outside vendor-supported product lines. NVD has flagged the record as "Not Scheduled" for further enrichment, explicitly citing resource constraints in prioritizing deeper analysis of this specific CVE.[access.redhat]

This status doesn't necessarily confirm Edimax has issued an official statement disclaiming a fix the way TRENDnet has for its own EOL router vulnerabilities, but the practical effect for defenders is the same: no clear vendor remediation path has been documented, and administrators should assume none is forthcoming until proven otherwise.

Remediation Guidance

With no confirmed vendor patch referenced across current disclosures, mitigation depends primarily on restricting exposure to the vulnerable interface.

• Check Edimax's official support channels for any firmware update addressing this specific PPPoE setup handler defect before assuming none exists.
• Disable remote or WAN-facing access to the router's management interface immediately.
• Restrict access to the PPPoE setup page to trusted, authenticated administrators only, ideally from a dedicated management network segment.
• If no patch is confirmed available, treat the device as a candidate for replacement with a currently supported router model.
• Monitor for unusually long or malformed pppUserName submissions in web server logs as a sign of active exploitation attempts.

Why This Matters

PPPoE setup pages are among the most routinely accessed configuration screens on consumer routers, since they're required for many DSL and fiber internet connections, making this an unusually exposed attack surface for a memory-corruption bug of this severity. Given the high CVSS score, public exploit availability, and the recurring pattern of similar unpatched overflow flaws across other embedded router firmware, administrators should prioritize verifying patch availability for this device rather than assuming it will be quietly fixed through routine updates.