{"id":"CVE-2026-129250","kind":"vulnerability","aliases":["CVE-2026-129250"],"related":[],"title":"Edimax BR-6478AC router: buffer overflow in PPTP setup lets attackers run code","description":"A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of the file webs. The manipulation of the argument pptpUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Edimax BR-6478AC V2 router firmware (version 1.23) has a buffer overflow in the formPPTPSetup handler when the pptpUserName argument is oversized. A remote attacker can exploit it without an account, and a public exploit has been released.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BR-6478AC V2 firmware","fixed":[],"affected":"1.23","ecosystem":"vendor"}],"ecosystems":[],"tags":["br-6478ac-v2","buffer-overflow","edimax","home-router","infrastructure","pptp","public-poc"],"not_affected_if":["other-firmware-versions"],"how_to_check":"Open the router's admin page and read the firmware version. 1.23 on a BR-6478AC V2 is the affected version. Other versions are not covered by the sources, so they are unknown. Also check whether the web admin page (port 80, /goform/formPPTPSetup) can be reached from the WAN or from untrusted LAN or Wi-Fi clients. Other Edimax models have similar formPPTPSetup bugs, but this record names only BR6478ACV2 1.23.","fix":"No fix: VulDB says Edimax was contacted early and did not respond, and no patch or mitigation is known. Check download.edimax.com for firmware newer than 1.23.","status":"open","published_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","triaged_at":"2026-11-14T12:30:28+00:00","updated_at":"2026-11-14T12:31:27+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-14T12:30:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Edimax BR-6478AC router: buffer overflow in PPTP setup lets attackers run code","impact":"high","summary":"The Edimax BR-6478AC V2 router firmware (version 1.23) has a buffer overflow in the formPPTPSetup handler when the pptpUserName argument is oversized. A remote attacker can exploit it without an account, and a public exploit has been released.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["edimax","br-6478ac-v2","home-router","pptp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker gains code execution on the router","analyst_note":"Confirm the affected firmware range, whether authentication is required, and whether the vendor has since issued a fix; check the NVD entry and any public exploit write-up.","how_to_check":"- Check the firmware version in the router's admin page and compare it with `1.23`\n- unknown","plain_action":"Check your Edimax BR-6478AC V2 router for a firmware update from Edimax; the vendor has not responded to the disclosure, so none may exist yet.","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions"],"who_is_affected":"Owners of Edimax BR-6478AC V2 routers running firmware 1.23 that expose the web administration interface or PPTP settings to the network or internet. Sources do not say whether the PPTP feature must be enabled to reach the vulnerable code. Devices from other vendors or other Edimax models are not named here.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000754,"input_tokens":4577,"output_tokens":593,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected firmware range, whether authentication is required, and whether the vendor has since issued a fix; check the NVD entry and any public exploit write-up.","search":"'-129250':17A,20A '-2026':16A,19A '1.23':51B,91C '6478ac':4A,23A,28B,46B 'account':74B 'argument':63B,107C 'attack':12A,68B,119C 'br':3A,22A,27B,45B 'br-6478ac':2A,21A,44B 'br-6478ac-v2':26B 'br6478acv2':90C 'buffer':6A,31B,54B,111C 'buffer-overflow':30B 'code':14A 'contact':134C 'cve':15A,18A 'detect':87C 'disclos':125C 'disclosur':138C 'earli':135C 'edimax':1A,33B,43B,89C 'element':94C 'exploit':70B,78B,122C 'file':101C 'firmwar':49B 'firmware':25A 'formpptpsetup':58B,98C 'function':97C 'handler':59B 'home':35B 'home-rout':34B 'impact':93C 'infrastructur':37B 'initi':117C 'lead':109C 'let':11A 'manipul':104C 'may':128C 'overflow':7A,32B,55B,112C 'overs':65B 'poc':41B 'possibl':115C 'pptp':9A,38B 'pptpusernam':62B,108C 'public':40B,77B,126C 'public-poc':39B 'releas':81B 'remot':67B,120C 'respond':142C 'router':5A,36B,48B 'run':13A 'secur':83C 'setup':10A 'use':130C 'v2':24A,29B,47B 'vendor':132C 'version':50B 'vulner':84C 'way':145C 'web':102C 'without':72B","nicknames":[],"mitigations":[],"who_affected":"Owners of the Edimax BR-6478AC V2 router running firmware 1.23. The flaw is in the web interface's PPTP setup handler (/goform/formPPTPSetup), so any network that can reach the router's web admin page is exposed. Sources do not agree on whether login is needed: the public PoC sends no credentials, while the CVSS vector says low privileges. Other firmware versions and other Edimax models are not confirmed affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check your Edimax BR-6478AC V2 router for a firmware update from Edimax. The vendor has not answered the report, so none may exist yet. Don't expose the router's admin page to the internet.","pkeys":["br6478acv2firmware","v2firmware"],"ptokens":["6478ac","br","firmware","v2"],"labels":["br6478acv2","bufferoverflow","critical","edimax","homerouter","infrastructure","pptp","publicpoc"],"campaign_type":null,"search_a":"'-129250':17A,20A '-2026':16A,19A '6478ac':4A,23A 'attack':12A 'br':3A,22A 'br-6478ac':2A,21A 'buffer':6A 'code':14A 'cve':15A,18A 'edimax':1A 'firmware':25A 'let':11A 'overflow':7A 'pptp':9A 'router':5A 'run':13A 'setup':10A 'v2':24A","search_b":"'1.23':51B '6478ac':28B,46B 'account':74B 'argument':63B 'attack':68B 'br':27B,45B 'br-6478ac':44B 'br-6478ac-v2':26B 'buffer':31B,54B 'buffer-overflow':30B 'edimax':33B,43B 'exploit':70B,78B 'firmwar':49B 'formpptpsetup':58B 'handler':59B 'home':35B 'home-rout':34B 'infrastructur':37B 'overflow':32B,55B 'overs':65B 'poc':41B 'pptp':38B 'pptpusernam':62B 'public':40B,77B 'public-poc':39B 'releas':81B 'remot':67B 'router':36B,48B 'v2':29B,47B 'version':50B 'without':72B","search_c":"'1.23':91C 'argument':107C 'attack':119C 'br6478acv2':90C 'buffer':111C 'contact':134C 'detect':87C 'disclos':125C 'disclosur':138C 'earli':135C 'edimax':89C 'element':94C 'exploit':122C 'file':101C 'formpptpsetup':98C 'function':97C 'impact':93C 'initi':117C 'lead':109C 'manipul':104C 'may':128C 'overflow':112C 'possibl':115C 'pptpusernam':108C 'public':126C 'remot':120C 'respond':142C 'secur':83C 'use':130C 'vendor':132C 'vulner':84C 'way':145C 'web':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-129250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129250","severity":null,"published_at":"2026-11-14T12:17:44+00:00","modified_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","fetched_at":"2026-11-14T12:28:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129250:3977","url":"https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad","severity":null,"published_at":"2026-11-14T12:31:27+00:00","modified_at":"2026-11-14T12:31:27+00:00","first_seen_at":"2026-11-14T12:31:27+00:00","fetched_at":"2026-11-14T12:31:27+00:00","note":"Read NVD, VulDB VDB-437280 and the researcher's Notion write-up with a PoC (POST /goform/formPPTPSetup, pptpUserName of 5000 'A's, sent with no credentials; strcat overflow). Only 1.23 is named as affected. Vendor did not respond and no fix or mitigation is known. No vendor page was read, so nothing is marked verified. VulDB's CVSS has PR:L, so whether login is needed is unsettled; the PoC shows no login step.","cites":["https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad","https://vuldb.com/vuln/437280","https://nvd.nist.gov/vuln/detail/CVE-2026-129250"]}],"documents":[{"id":155483,"url":"https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad","title":"EDIMAX-BR6478ACV2-formPPTPSetup (researcher write-up and PoC)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":155484,"url":"https://vuldb.com/vuln/437280","title":"VulDB VDB-437280","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":155485,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129250","title":"NVD CVE-2026-129250","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[{"type":"poc","url":"https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}