CVE-2026-9381 Overview
CVE-2026-9381 is a buffer overflow vulnerability in the Edimax BR-6675nD router, firmware version 1.12. The flaw resides in the formPPPoESetup function handling POST requests sent to /goform/formPPPoESetup. An attacker can manipulate the pppUserName parameter to overflow a fixed-size buffer in the request handler. The vulnerability is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vendor was contacted before public disclosure but did not respond. A public exploit is now available, increasing the likelihood of opportunistic attacks against exposed devices.
Critical Impact
Remote attackers with low-privilege access can corrupt router memory via the pppUserName POST parameter, leading to potential code execution or device compromise on Edimax BR-6675nD 1.12.
Affected Products
- Edimax BR-6675nD router
- Firmware version 1.12
- Component: POST request handler (/goform/formPPPoESetup)
Discovery Timeline
- 2026-05-24 - CVE-2026-9381 published to NVD
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9381
Vulnerability Analysis
The vulnerability exists in the formPPPoESetup handler exposed by the router's HTTP administration interface. When a client submits a POST request to /goform/formPPPoESetup, the handler reads the pppUserName argument from the request body and copies it into a fixed-size internal buffer without enforcing length validation. Supplying an oversized value for pppUserName overflows the buffer and corrupts adjacent memory in the web server process. Because the BR-6675nD runs the affected service with elevated privileges on an embedded Linux platform, successful exploitation can disrupt router operation or allow attackers to execute arbitrary code on the device. The attack requires network access to the management interface and a low-privilege authenticated session.
Root Cause
The root cause is missing bounds checking on user-supplied input in the formPPPoESetup function. The handler uses an unchecked copy of the pppUserName POST parameter into a stack or static buffer, a classic [CWE-119] pattern frequently seen in embedded goform handlers built on the Boa or GoAhead web server stack.
Attack Vector
An attacker reaches the vulnerability remotely over the network by sending a crafted HTTP POST request to /goform/formPPPoESetup containing an overlong pppUserName value. Exploitation requires authenticated access to the web administration interface. Devices exposing the management UI to untrusted networks materially increase exposure. Public exploit details are referenced in the VulDB advisory for entry #365344 and the technical writeup on Notion.
No verified proof-of-concept code is reproduced here. Refer to the linked technical writeup for exploitation specifics.
Detection Methods for CVE-2026-9381
Indicators of Compromise
- HTTP POST requests to /goform/formPPPoESetup containing abnormally long pppUserName values exceeding typical PPPoE username length limits.
- Web administration service crashes, unexpected reboots, or watchdog-triggered restarts on Edimax BR-6675nD devices.
- Unexpected configuration changes to PPPoE settings or new administrative sessions originating from untrusted networks.
Detection Strategies
- Inspect HTTP request bodies destined for the router management interface and flag pppUserName parameters exceeding a conservative byte threshold.
- Correlate router HTTP access logs with subsequent service crashes or connectivity loss as a behavioral signal for exploitation attempts.
- Apply network IDS signatures that match POST requests to /goform/formPPPoESetup containing oversized form fields.
Monitoring Recommendations
- Forward router syslog and HTTP access logs to a centralized log platform for retention and anomaly analysis.
- Alert on any external IP address reaching the router administration port, which should not be exposed to the internet.
- Monitor for repeated authentication failures or rapid POST request bursts targeting /goform/ endpoints.
How to Mitigate CVE-2026-9381
Immediate Actions Required
- Disable remote administration on the WAN interface and restrict the management UI to trusted LAN segments only.
- Change default and weak administrative credentials to reduce the likelihood of an attacker obtaining the low-privilege access required for exploitation.
- Place affected BR-6675nD devices behind a network firewall that blocks inbound HTTP/HTTPS to the management interface.
Patch Information
No vendor patch is currently available. The vendor did not respond to the disclosure attempt referenced in the VulDB submission. Organizations should plan for device replacement if the BR-6675nD is deployed in environments requiring continued vendor support.
Workarounds
- Segment Edimax BR-6675nD devices onto isolated VLANs and block lateral access from general user networks.
- Replace end-of-support hardware with current-generation routers that receive active firmware updates.
- Where feasible, terminate PPPoE on a separately managed edge device and reduce reliance on the vulnerable handler.
# Example: block external access to the router management interface
iptables -I INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -I INPUT -i wan0 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
