CVE-2026-10164: Edimax BR-6478AC Buffer Overflow Remote Code Execution

Technical summary

CVE-2026-10164 is a stack-based buffer overflow (CWE-119, CWE-120) in the formUSBFolder function within the /goform/formUSBFolder POST request handler of Edimax BR-6478AC firmware 1.23. Improper input validation on the ShareName and SelectName parameters allows an authenticated attacker to write beyond allocated buffer boundaries, corrupting the stack and potentially achieving remote code execution. The vulnerability has a CVSS 3.1 score of 8.8 (HIGH), reflecting high impact across confidentiality, integrity, and availability with low attack complexity and no user interaction required once authenticated.

Business impact

Successful exploitation enables an authenticated attacker to fully compromise the affected router, potentially allowing them to intercept network traffic, redirect users to malicious sites, modify DNS settings, conduct man-in-the-middle attacks, or use the device as a pivot point into corporate or home networks. For organizations using these devices in office environments or remote access scenarios, this represents a lateral movement risk and potential data exfiltration vector.

Affected systems

This vulnerability affects Edimax BR-6478AC routers running firmware version 1.23. Organizations should inventory these devices, particularly in guest networks, branch offices, or BYOD environments where they might be deployed without centralized monitoring. The vendor has not yet released a comprehensive list of all affected versions, so verify firmware versions across your estate.

Exploitability

The vulnerability requires valid credentials (authentication prerequisite), but does not require user interaction beyond sending a malformed POST request. The low attack complexity combined with public exploit availability creates a moderate-to-high risk that attackers with router access will attempt exploitation. Insider threats or compromised user accounts pose the most immediate concern. Remote unauthenticated exploitation is not possible based on the current attack vector.

Remediation

Organizations must identify and patch or retire affected BR-6478AC devices running firmware 1.23. Verify the latest available firmware version from Edimax support channels and apply it across all vulnerable instances. If patches are unavailable or delayed, implement network segmentation to restrict administrative access to the router management interface, disable SSH or web management remotely if not required, and monitor for suspicious USB folder sharing requests.

Patch guidance

Check Edimax's official support portal for firmware updates beyond version 1.23 for the BR-6478AC model. Establish a testing window in a non-production environment before rolling out patches. Document the firmware version deployed on each device and create a phased deployment schedule. If patch availability is delayed, maintain an inventory of affected devices and prioritize replacement or decommissioning on a risk-based timeline.

Detection guidance

Monitor router logs for POST requests to /goform/formUSBFolder with abnormally long or binary-encoded parameters in ShareName or SelectName fields. Intrusion detection systems should flag requests containing special characters, excessive URL encoding, or payloads exceeding normal input lengths for these parameters. Network telemetry can also track unexpected outbound connections or DNS modifications after router access events. Enable detailed logging on router management interfaces if supported.

Why prioritize this

This vulnerability merits prompt attention due to its HIGH CVSS score (8.8), public exploit availability, and the router's role as a network gateway. Although authentication is required, the device's position makes it an attractive target for lateral movement, and once compromised, it threatens all devices connected to it. Organizations with BR-6478AC devices deployed should treat this as higher priority than many other vulnerabilities despite the authentication requirement.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact (complete compromise possible), low attack complexity, and a network-accessible attack vector. The authentication requirement prevents the theoretical maximum score, but public exploit availability and the device's strategic network position elevate practical risk significantly above the base score for most deployments.

Frequently asked questions