CVE-2026-10126: Edimax BR-6478AC Buffer Overflow Remote Code Execution

Technical summary

CVE-2026-10126 is a classic buffer overflow (CWE-119, CWE-120) in the formQoS POST handler within Edimax BR-6478AC firmware 1.23. The vulnerability stems from insufficient bounds checking on the selSSID argument, permitting stack or heap corruption. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) reflects remote exploitability, low attack complexity, requirement for valid authentication, and potential for high confidentiality, integrity, and availability impact. The attack surface is the unauthenticated-looking /goform/formQoS endpoint, which in practice requires valid session credentials.

Business impact

Organizations deploying Edimax BR-6478AC routers as edge devices or in remote office setups face operational disruption (device crash/reboot) and potential unauthorized access to network segments behind the router. If an attacker with router admin credentials (obtained through phishing, credential compromise, or insider threat) exploits this flaw, they could achieve code execution with router privileges, enabling network reconnaissance, traffic interception, or lateral movement into connected systems. For managed service providers or organizations managing fleets of these devices, exploitation could trigger widespread incidents.

Affected systems

Edimax BR-6478AC version 1.23 is confirmed affected. The vendor product list is currently empty in available databases; users should verify whether other Edimax models or firmware versions in the BR-64xx AC series or similar product lines are similarly vulnerable by consulting Edimax security advisories. Organizations should audit their device inventory to identify all Edimax routers in production and prioritize BR-6478AC units.

Exploitability

Exploitability is high: the vulnerability is network-reachable, requires only low attack complexity (straightforward buffer overflow trigger), and public exploit code is available. However, a meaningful limiting factor is the requirement for authenticated access—the attacker must possess valid router credentials. The combination of public PoCs and the relatively simple nature of buffer overflow attacks means that once internal access is obtained or credentials are compromised, exploitation is trivial. Given this is an older device class (home/small office router), credential reuse and weak default settings increase real-world risk.

Remediation

Upgrade Edimax BR-6478AC to a firmware version newer than 1.23 that includes this buffer overflow fix—verify the specific patched version against Edimax's official security advisory and firmware download page. If a patch is unavailable, isolate affected routers to trusted networks only, disable remote administration features, enforce strong authentication (change default credentials immediately), and consider network segmentation to limit the blast radius. Monitor for suspicious POST requests to /goform/formQoS.

Patch guidance

Contact Edimax support or visit their firmware download portal to obtain a patched firmware release for BR-6478AC. Firmware updates for this device class are typically delivered via the web administration interface or as a downloadable binary for manual installation. Verify the release notes confirm CVE-2026-10126 remediation before deployment. Test in a non-production environment first, as router firmware updates may cause brief network outages. Ensure automatic credential reset is disabled during update to avoid lockout.

Detection guidance

Monitor network traffic for POST requests to /goform/formQoS with abnormally large or malformed selSSID parameter values. Analyze router access logs for failed QoS configuration attempts or error messages indicating buffer issues. Intrusion detection signatures should flag oversized parameter injection attempts targeting this endpoint. Check router firmware version via the web interface or CLI and cross-reference against Edimax's known-vulnerable versions. Correlate any device crashes or unexpected reboots with recent QoS configuration changes or remote access patterns.

Why prioritize this

This vulnerability merits rapid attention due to its HIGH CVSS score (8.8), public exploit availability, and potential for confidentiality and integrity compromise despite the authentication requirement. Any organization running BR-6478AC units should treat patching as urgent, especially those with internet-facing device management or users with compromised credentials. The combination of buffer overflow severity and public PoC exploitation means delay significantly increases breach probability.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the high potential impact (confidentiality, integrity, and availability all achievable through code execution), remote attack surface, and low attack complexity. The main factor preventing a CRITICAL rating is the prerequisite of valid authentication, which introduces a modest but material barrier. However, in environments with weak credential hygiene or where router admin accounts have been compromised, this barrier effectively dissolves, making the practical risk closer to CRITICAL in those contexts.

Frequently asked questions