---
id: "CVE-2026-129250"
page: "https://infrastack.ai/live/CVE-2026-129250"
kind: "vulnerability"
aliases: ["CVE-2026-129250"]
title: "Edimax BR-6478AC router: buffer overflow in PPTP setup lets attackers run code"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "BR-6478AC V2 firmware", "fixed": [], "affected": "1.23", "ecosystem": "vendor"}]
ecosystems: []
tags: ["br-6478ac-v2", "buffer-overflow", "edimax", "home-router", "infrastructure", "pptp", "public-poc"]
not_affected_if: ["other-firmware-versions"]
published_at: "2026-11-14T12:17:44+00:00"
first_seen_at: "2026-11-14T12:28:31+00:00"
updated_at: "2026-11-14T12:31:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129250", "first_seen_at": "2026-11-14T12:28:31+00:00"}, {"source": "analyst", "url": "https://vuldb.com/vuln/437280", "first_seen_at": "2026-11-14T12:31:27+00:00", "cites": ["https://vuldb.com/vuln/437280", "https://nvd.nist.gov/vuln/detail/CVE-2026-129250", "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad"]}]
exploit_sources: [{"type": "poc", "url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad"}]
---

# Edimax BR-6478AC router: buffer overflow in PPTP setup lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-129250 (this .md is for agents)

The Edimax BR-6478AC V2 router firmware (version 1.23) has a buffer overflow in the formPPTPSetup handler when the pptpUserName argument is oversized. A remote attacker can exploit it without an account, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BR-6478AC V2 firmware affected 1.23 fixed no fixed version listed

## How to check

Open the router's admin page and read the firmware version. 1.23 on a BR-6478AC V2 is the affected version. Other versions are not covered by the sources, so they are unknown. Also check whether the web admin page (port 80, /goform/formPPTPSetup) can be reached from the WAN or from untrusted LAN or Wi-Fi clients. Other Edimax models have similar formPPTPSetup bugs, but this record names only BR6478ACV2 1.23.

## Fix

No fix: VulDB says Edimax was contacted early and did not respond, and no patch or mitigation is known. Check download.edimax.com for firmware newer than 1.23.

## Timeline

- 2026-11-14T12:28:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129250
- 2026-11-14T12:31:27+00:00 analyst https://vuldb.com/vuln/437280 — Read NVD, VulDB VDB-437280 and the researcher's Notion write-up with a PoC (POST /goform/formPPTPSetup, pptpUserName of 5000 'A's, sent with no credentials; strcat overflow). Only 1.23 is named as affected. Vendor did not respond and no fix or mitigation is known. No vendor page was read, so nothing is marked verified. VulDB's CVSS has PR:L, so whether login is needed is unsettled; the PoC shows no login step.

## Documents

- [describes] VulDB VDB-437280 https://vuldb.com/vuln/437280
- [describes] NVD CVE-2026-129250 https://nvd.nist.gov/vuln/detail/CVE-2026-129250
- [poc] EDIMAX-BR6478ACV2-formPPTPSetup (researcher write-up and PoC) https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formPPTPSetup-3f953a41781f8017b959ec7b4df6b3ad

## From the sources

A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of the file webs. The manipulation of the argument pptpUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_