CVE-2026-12806: Edimax BR-6478AC Buffer Overflow Flaw

CVE-2026-12806 Overview

CVE-2026-12806 is a buffer overflow vulnerability in the Edimax BR-6478AC V2 wireless router running firmware version 1.23. The flaw resides in the formWlSiteSurvey function handling POST requests to /goform/formWlSiteSurvey. Attackers can trigger the overflow by manipulating the selSSID parameter, corrupting memory on the embedded device. The vulnerability is exploitable remotely over the network and the technical details have been disclosed publicly. According to the disclosure record, the vendor was contacted before publication but did not respond. The flaw maps to [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers with low privileges can overflow a stack buffer through the selSSID POST parameter, leading to memory corruption and potential code execution on the router.

Affected Products

Edimax BR-6478AC V2 wireless router
Firmware version 1.23
Component: /goform/formWlSiteSurvey POST request handler

Discovery Timeline

2026-06-21 - CVE-2026-12806 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-12806

Vulnerability Analysis

The Edimax BR-6478AC V2 exposes a web administration interface that processes wireless site survey requests through the formWlSiteSurvey handler. This handler is registered under the /goform/ URL namespace, a common pattern in embedded router firmware built on the Boa or GoAhead web servers. When a client submits a POST request containing the selSSID argument, the handler copies the attacker-supplied value into a fixed-size stack buffer without validating the input length. Supplying an oversized selSSID value overruns the destination buffer and corrupts adjacent stack memory, including saved return addresses on MIPS or ARM router CPUs. The exploit details are public, which lowers the barrier to weaponization against exposed devices.

Root Cause

The root cause is missing bounds checking on user-controlled input in the formWlSiteSurvey function. The implementation relies on unsafe string operations such as strcpy or sprintf rather than length-bounded equivalents. Because the selSSID parameter is parsed directly from the POST body into a stack-resident buffer, an attacker controls both the size and contents of the overflow data.

Attack Vector

Exploitation requires network access to the router's administrative HTTP interface and low-privilege authentication. An attacker sends a crafted POST request to /goform/formWlSiteSurvey with an oversized selSSID parameter value. Successful exploitation can crash the device or, with appropriate gadget chaining, redirect control flow to attacker-supplied shellcode. Routers with administrative interfaces reachable from untrusted networks face the highest exposure.

No verified proof-of-concept code is included here. See the Notion Site Survey Document and VulDB CVE-2026-12806 for the disclosed technical details.

Detection Methods for CVE-2026-12806

Indicators of Compromise

POST requests to /goform/formWlSiteSurvey containing unusually long selSSID parameter values
Unexpected router reboots, watchdog resets, or httpd process crashes coinciding with administrative HTTP traffic
New or modified configuration entries on the router following anomalous management-interface activity

Detection Strategies

Inspect HTTP request bodies at the network perimeter for selSSID field lengths exceeding typical SSID limits (32 bytes per IEEE 802.11)
Alert on POST traffic to /goform/formWlSiteSurvey originating from non-administrative network segments
Correlate router syslog crash events with inbound HTTP requests to the management interface

Monitoring Recommendations

Forward router and IDS logs to a central analytics platform and baseline normal management-interface usage
Monitor for outbound connections initiated by the router to unfamiliar hosts, which can indicate post-exploitation activity
Track device availability and CPU metrics via SNMP to surface stability anomalies tied to exploitation attempts

How to Mitigate CVE-2026-12806

Immediate Actions Required

Restrict access to the router's web administration interface to trusted management VLANs or specific source IP addresses
Disable remote (WAN-side) administrative access on the BR-6478AC V2 until a patch is available
Rotate administrative credentials and audit the device configuration for unauthorized changes
Consider replacing the device if it has reached end-of-support and the vendor remains unresponsive to the disclosure

Patch Information

At the time of publication, no vendor patch is referenced in the disclosure. The reporter notes that Edimax was contacted before public disclosure but did not respond. Operators should monitor the Edimax support site and the VulDB entry for CVE-2026-12806 for firmware updates addressing the formWlSiteSurvey handler.

Workarounds

Place the router behind an upstream firewall and block inbound TCP/80 and TCP/443 to the management interface from untrusted networks
Use access control lists on managed switches to limit which clients can reach the router's administrative IP
Segment guest and IoT networks so that compromised wireless clients cannot reach the router's HTTP interface
Evaluate migration to a firmware with active security maintenance, such as a supported OpenWrt build for compatible hardware

bash

# Example: restrict router management interface to a single admin host using iptables on an upstream Linux gateway
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -s 10.10.0.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -s 10.10.0.5 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP