CVE-2026–10126: A Remote Buffer Overflow in Edimax BR-6478AC

A high-severity vulnerability has been identified in the Edimax BR-6478AC router running firmware version 1.23. Tracked as CVE-2026–10126, the issue affects the device's web-based management interface and has a publicly released exploit.[nvd.nist]

The vulnerable component

The flaw is located in the formQoS function, exposed through the /goform/formQoS endpoint in the POST request handler. An attacker can manipulate the selSSID argument in a crafted POST request, causing a buffer overflow.[nvd.nist]

A buffer overflow occurs when an application writes more data into a memory buffer than it was designed to hold. Without proper length validation, the excess data may overwrite adjacent memory and alter the behavior of the affected process. The vulnerability is classified as CWE-119, improper restriction of operations within a memory buffer, and CWE-120, the classic buffer-copy-without-size-checking weakness.[nvd.nist]

Severity and attack conditions

The vulnerability has a CVSS 3.1 score of 8.8 out of 10, rated High. Its vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.[nvd.nist]

This means the attack can be performed over the network, requires low complexity, and does not depend on victim interaction. However, the attacker needs low-level privileges on the device, so the issue should not automatically be interpreted as unauthenticated internet-wide compromise.[nvd.nist]

If an attacker can access the router's administrative interface with sufficient permissions, a malicious request targeting formQoS could corrupt memory in the web-management process. Potential consequences include service disruption, device instability, or—in a successful and device-specific exploitation chain—code execution in the context of the vulnerable component.

The public record confirms the buffer overflow and states that an exploit has been released. It does not, by itself, prove reliable remote code execution under every configuration; that would require controlled validation on the affected hardware and firmware.[nvd.nist]

Why public exploitation matters

The availability of public exploit material changes the risk profile. It lowers the technical barrier for reproducing the vulnerability and makes timely assessment more important for organizations and home users operating the affected router.[nvd.nist]

The vulnerability record specifically identifies Edimax BR-6478AC version 1.23. Administrators should avoid assuming that every Edimax product — or every firmware release for this model — is affected without checking the installed version against vendor information.[nvd.nist]

Recommended mitigations

At the time of writing, the NVD record does not list a patched version or a vendor-supplied remediation. It also states that the CVE is not scheduled for prioritised NVD enrichment, so owners should monitor Edimax directly for firmware updates and security notices.[nvd.nist]

Until a verified fix is available, affected users should take practical steps to reduce exposure:

• Confirm whether the device is an Edimax BR-6478AC running firmware version 1.23.[nvd.nist]
• Disable remote administration unless it is strictly required.
• Do not expose the router's management panel directly to the public internet.
• Restrict administrative access to the local network or to a separate management network.
• Replace default or weak credentials with unique, strong passwords.
• Use firewall rules or access-control lists to restrict access to the web-management interface.
• Apply only verified firmware updates from the vendor when they become available.

A familiar IoT security pattern

CVE-2026–10126 is another example of how configuration features can become high-impact attack surfaces in network appliances. Functions associated with QoS, wireless configuration, and device administration often process user-controlled input, making strict validation and memory-safe coding essential.

In this case, the selSSID parameter handled by formQoS is enough to expose a classic memory-corruption condition. For defenders, the immediate priority is reducing management-interface exposure; for researchers, any testing should be conducted only on owned or explicitly authorized devices in an isolated environment.[nvd.nist]