BR-6478AC V2 FIRMWARE · CVE-2026-129250 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The Edimax BR-6478AC V2 router firmware (version 1.23) has a buffer overflow in the formPPTPSetup handler when the pptpUserName argument is oversized. A remote attacker can exploit it without an account, and a public exploit has been released.
first public Nov 14, 2026 · 1 public exploit · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of the Edimax BR-6478AC V2 router running firmware 1.23. The flaw is in the web interface's PPTP setup handler (/goform/formPPTPSetup), so any network that can reach the router's web admin page is exposed. Sources do not agree on whether login is needed: the public PoC sends no credentials, while the CVSS vector says low privileges. Other firmware versions and other Edimax models are not confirmed affected.
Not affected if other-firmware-versions
Who cares br-6478ac-v2, buffer-overflow, edimax, home-router, pptp, public-poc
Posts are quoted with a link to the original. They are data to us, never instructions.
A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of the file webs. The manipulation of the argument pptpUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.