CVE-2026-9382 Overview
CVE-2026-9382 is a buffer overflow vulnerability in the Edimax BR-6675nD router running firmware version 1.12. The flaw exists in the formPPTPSetup function inside /goform/formPPTPSetup, which handles POST requests for Point-to-Point Tunneling Protocol (PPTP) configuration. An authenticated attacker can manipulate the pptpUserName argument to overflow a fixed-size buffer. The attack can be launched remotely over the network. According to the disclosure, an exploit has been published, and the vendor was contacted but did not respond. This issue is classified under CWE-119, improper restriction of operations within the bounds of a memory buffer.
Critical Impact
Successful exploitation can corrupt memory in the router's HTTP service, enabling arbitrary code execution or device crash and disruption of network connectivity.
Affected Products
- Edimax BR-6675nD wireless router
- Firmware version 1.12
- formPPTPSetup handler within the device web management interface
Discovery Timeline
- 2026-05-24 - CVE-2026-9382 published to the National Vulnerability Database (NVD)
- 2026-05-26 - Last updated in NVD database
Technical Details for CVE-2026-9382
Vulnerability Analysis
The vulnerability resides in the formPPTPSetup function exposed at the /goform/formPPTPSetup endpoint. This handler processes POST parameters submitted from the router's PPTP client configuration page. The pptpUserName parameter is copied into a fixed-length stack buffer without sufficient length validation. Supplying an overlong value overflows adjacent memory, including saved registers and the return address on MIPS-based embedded firmware typical of consumer routers.
Because the device runs the web service with elevated privileges and lacks modern exploit mitigations such as stack canaries and full address space layout randomization (ASLR), the overflow is directly exploitable for control-flow hijack. The attacker must hold valid low-privilege credentials, which on many residential routers means access to the default or administrator account. Once exploited, the attacker gains code execution on the router operating system.
Root Cause
The root cause is the absence of bounds checking on user-controlled input copied into a stack buffer. The handler relies on an unsafe string copy operation when parsing the pptpUserName field, classifying the defect as [CWE-119]. No input length validation is performed on the server side before the copy occurs.
Attack Vector
The attack vector is network-based against the router's HTTP management interface. The attacker authenticates to the web console, then submits a crafted POST request to /goform/formPPTPSetup with an oversized pptpUserName value. Exploitation requires reachability of the management interface, which is often exposed on the LAN and, in misconfigured deployments, on the WAN. A published proof of concept is referenced in the VulDB entry #365345 and the Notion PPTP Setup writeup.
No verified exploit code is reproduced here. Refer to the linked advisories for technical proof-of-concept details.
Detection Methods for CVE-2026-9382
Indicators of Compromise
- POST requests to /goform/formPPTPSetup containing abnormally long pptpUserName values, typically exceeding several hundred bytes.
- Unexpected reboots, watchdog resets, or httpd crashes on the Edimax BR-6675nD device.
- Unauthorized changes to PPTP, DNS, or routing configuration following management-interface activity.
Detection Strategies
- Inspect HTTP request bodies destined for /goform/ endpoints and alert on parameter lengths that exceed expected limits.
- Correlate authenticated administrative sessions with subsequent service restarts on the router to identify post-exploitation behavior.
- Apply intrusion detection signatures targeting overlong PPTP credential fields in router management traffic.
Monitoring Recommendations
- Forward router syslog and authentication events to a centralized logging or SIEM platform for retention and correlation.
- Monitor the WAN interface for inbound connection attempts to TCP ports 80 and 443 of the router management plane.
- Track DNS and DHCP configuration drift on small office and home office networks where the BR-6675nD is deployed.
How to Mitigate CVE-2026-9382
Immediate Actions Required
- Restrict access to the router web management interface to trusted LAN hosts only and disable remote WAN administration.
- Change default and weak administrative credentials to reduce the pool of attackers able to reach the authenticated endpoint.
- Disable the PPTP client feature on the device if it is not in active use to remove the vulnerable code path from reachable functionality.
- Plan replacement of the BR-6675nD, which is a legacy product with no acknowledged vendor response to this disclosure.
Patch Information
No vendor patch is available at the time of writing. The disclosure notes that Edimax was contacted early but did not respond. Administrators should treat the device as unsupported for this issue and prioritize compensating controls or hardware replacement. Track the VulDB advisory for any future vendor update.
Workarounds
- Place the router behind a network segment that filters inbound HTTP and HTTPS traffic to its management interface using an upstream firewall.
- Use access control lists to permit administrative connections only from a dedicated management workstation.
- Replace the affected device with a currently supported router that receives security updates from its vendor.
# Example: restrict router admin interface to a single management host using iptables on an upstream Linux gateway
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.1 --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
