CVE-2026-100745: Edimax BR-6428nC Buffer Overflow Vulnerability

CVE-2026-100745 Overview

CVE-2026-100745 is a stack-based buffer overflow [CWE-119] in the Edimax BR-6428nC wireless router running firmware version 1.16. The flaw resides in the Wireless Wizard Handler, specifically in the /goform/formWizSurvey endpoint. Attackers can trigger the overflow by manipulating the interface1 or interface2 arguments submitted to this handler. The vulnerability is remotely exploitable over the network and requires low-level privileges. Public disclosure of the exploit technique increases the probability that opportunistic actors will weaponize it against exposed devices.

Critical Impact
Remote attackers with low privileges can corrupt the router's stack memory through crafted HTTP requests to the wireless survey endpoint, potentially impacting device confidentiality, integrity, and availability.

Affected Products

Edimax BR-6428nC wireless router
Firmware version 1.16
Wireless Wizard Handler component (/goform/formWizSurvey)

Discovery Timeline

2026-09-27 - CVE-2026-100745 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100745

Vulnerability Analysis

The vulnerability affects the HTTP form handler at /goform/formWizSurvey, which processes user input from the device's wireless setup wizard. The handler accepts interface1 and interface2 parameters without enforcing bounds on their length. When oversized input is supplied, the handler copies the data into a fixed-size stack buffer, overwriting adjacent stack memory. This category of flaw is tracked as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Corruption of the saved return address can redirect execution flow on the embedded MIPS or ARM processor used in the device. Successful exploitation can disrupt router operations and may enable code execution within the web management process context.

Root Cause

The root cause is missing length validation on the interface1 and interface2 parameters before they are written to a stack-allocated buffer inside the formWizSurvey handler. The handler trusts attacker-controlled HTTP form data and performs an unsafe copy operation. This pattern is common in embedded web servers that rely on functions like strcpy or sprintf without bounds checking.

Attack Vector

An attacker reaches the vulnerable endpoint by sending an HTTP POST request to /goform/formWizSurvey on the router's management interface. The attacker needs low-privileged access to the web interface, which on many Edimax deployments means the default or weak administrative credentials. Devices with the management interface exposed to the WAN are at higher risk. The exploit has been publicly disclosed through VulDB and a researcher writeup, lowering the barrier to weaponization.

For technical write-up details, see the Notion Survey Stack Overflow analysis and the VulDB CVE-2026-100745 entry.

Detection Methods for CVE-2026-100745

Indicators of Compromise

Unexpected HTTP POST requests to /goform/formWizSurvey containing abnormally long interface1 or interface2 parameter values.
Router reboots, watchdog resets, or crashes of the embedded httpd process following receipt of wizard survey requests.
Unauthenticated or newly-authenticated administrative sessions originating from unfamiliar source IP addresses.

Detection Strategies

Inspect HTTP traffic to the router's management interface for POST requests to /goform/formWizSurvey with parameter lengths exceeding typical interface name sizes.
Correlate web server crashes with preceding HTTP requests to identify exploitation attempts against the wizard handler.
Deploy network IDS signatures that match oversized interface1/interface2 values in form-encoded payloads.

Monitoring Recommendations

Monitor syslog output from the router for repeated process restarts or stack trace indicators.
Alert on administrative logins from external IP ranges if the WAN management interface is enabled.
Capture and retain NetFlow or packet metadata for the router's management VLAN to support investigation.

How to Mitigate CVE-2026-100745

Immediate Actions Required

Disable remote (WAN-side) administration on the Edimax BR-6428nC until a firmware update is confirmed available.
Restrict access to the device's web management interface to a trusted management VLAN or specific administrator hosts.
Change default administrative credentials and enforce strong passwords to reduce the pool of low-privileged attackers.
Review router logs for signs of exploitation attempts against /goform/formWizSurvey.

Patch Information

No vendor patch for Edimax BR-6428nC firmware 1.16 has been published in the available references at the time of CVE assignment. Monitor the Edimax support site for firmware releases addressing CVE-2026-100745, and consult the VulDB vulnerability record for ongoing updates.

Workarounds

Place the device behind a perimeter firewall and block inbound TCP traffic to the router's HTTP management port from untrusted networks.
Segment IoT and consumer-grade network equipment onto a dedicated VLAN with egress filtering to limit lateral movement after compromise.
Replace unsupported or end-of-life devices with vendor-supported alternatives that receive regular firmware updates.

bash

# Example: block external access to router management port using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -i <wan_interface> -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -i <wan_interface> -j DROP