CVE-2026-9399: Edimax BR-6675nD Buffer Overflow Flaw

CVE-2026-9399 Overview

CVE-2026-9399 is a buffer overflow vulnerability in the Edimax BR-6675nD router running firmware version 1.12. The flaw resides in the formsetPPPoE function within /goform/formsetPPPoE, which is reachable through the device's POST request handler. An attacker can manipulate the pppUserName argument to trigger memory corruption. The issue is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer. Remote exploitation is possible, and a public exploit has been disclosed. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Authenticated remote attackers can corrupt memory on affected Edimax BR-6675nD routers through the pppUserName parameter, potentially leading to denial of service or arbitrary code execution on the router.

Affected Products

Edimax BR-6675nD firmware version 1.12
Component: POST Request Handler — /goform/formsetPPPoE
Vulnerable function: formsetPPPoE

Discovery Timeline

2026-05-24 - CVE-2026-9399 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9399

Vulnerability Analysis

The vulnerability exists in the formsetPPPoE handler exposed under /goform/formsetPPPoE on the router's HTTP administration interface. When a POST request is submitted, the handler reads the pppUserName parameter and copies it into a fixed-size buffer without enforcing a length check. Supplying an oversized value causes adjacent memory to be overwritten, producing a classic stack or heap buffer overflow as described by [CWE-119]. The attack vector is network-based with low complexity, and exploitation requires only low-privileged access to the management interface. Successful exploitation can disrupt router operation or, depending on memory layout and protections present in the firmware, allow arbitrary code execution in the context of the web server process.

Root Cause

The root cause is missing bounds validation on the pppUserName field before it is written into a fixed-length buffer inside formsetPPPoE. PPPoE credential fields on consumer routers are commonly handled by unsafe C string routines such as strcpy or sprintf, which propagate user-controlled length into a stack frame. The handler does not truncate, length-check, or sanitize the incoming parameter.

Attack Vector

Exploitation requires the attacker to send a crafted HTTP POST request to /goform/formsetPPPoE containing an overlong pppUserName value. The request must originate from a session with access to the router's web UI, which on many BR-6675nD deployments is reachable from the LAN and, where remote administration is enabled, from the WAN. The exploit is publicly available per the VulDB submission, increasing the likelihood of opportunistic scanning and weaponization. No verified proof-of-concept code is reproduced here. Refer to the VulDB Vulnerability #365380 and Notion Resource Document for technical specifics.

Detection Methods for CVE-2026-9399

Indicators of Compromise

HTTP POST requests to /goform/formsetPPPoE containing abnormally long pppUserName values, particularly strings exceeding typical PPPoE username lengths of 64 bytes.
Unexpected reboots, web UI crashes, or loss of management plane availability on Edimax BR-6675nD routers.
New or unexplained PPPoE session resets and WAN connectivity instability following inbound administrative traffic.

Detection Strategies

Inspect web server and router syslog output for repeated POST requests to /goform/formsetPPPoE from a single source within a short time window.
Deploy network IDS signatures that flag HTTP POST bodies containing pppUserName fields above a defined length threshold.
Correlate router crash events with preceding HTTP traffic to the formsetPPPoE endpoint to surface exploitation attempts.

Monitoring Recommendations

Centralize router logs and HTTP access records in a SIEM and alert on writes to /goform/formsetPPPoE from non-administrative source IPs.
Monitor WAN-side scanning for HTTP probes targeting goform endpoints, which are characteristic of consumer router enumeration.
Track device availability metrics for the BR-6675nD fleet to identify clustered outages consistent with mass exploitation.

How to Mitigate CVE-2026-9399

Immediate Actions Required

Disable remote (WAN-side) administration on all Edimax BR-6675nD devices to remove internet exposure of /goform/formsetPPPoE.
Restrict LAN access to the web management interface to a dedicated management VLAN or specific administrator workstations.
Rotate router administrator credentials and enforce strong, unique passwords to limit low-privileged access required for exploitation.
Inventory affected devices and plan replacement, since the vendor did not respond to disclosure and no patch is currently published.

Patch Information

No vendor patch is available at the time of publication. Edimax did not respond to the disclosure attempt referenced in the VulDB Submission #811561. Organizations should monitor the Edimax support portal for firmware updates and consider migrating off the BR-6675nD platform if a fix is not released.

Workarounds

Place affected routers behind a separate firewall and block inbound HTTP/HTTPS to the management interface from untrusted networks.
Apply a web application firewall or reverse proxy in front of the management UI that enforces a maximum length on the pppUserName parameter.
Where possible, configure PPPoE credentials once and disable further write access to the configuration interface for day-to-day users.

bash

# Example: block external access to the vulnerable endpoint on an upstream firewall
iptables -I FORWARD -p tcp --dport 80 -m string \
  --algo bm --string "/goform/formsetPPPoE" -j DROP
iptables -I FORWARD -p tcp --dport 443 -m string \
  --algo bm --string "/goform/formsetPPPoE" -j DROP