This vulnerability affects Edimax BR-6478AC version 1.23 and involves a stack-based buffer overflow in the formPPPoESetup function of the POST request handler. The issue arises from improper validation or handling of the pppUserName parameter, which can be manipulated remotely to overflow the stack buffer. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability can lead to remote code execution or denial of service on the affected device, compromising the confidentiality, integrity, and availability of the router. Since the attack can be initiated remotely without authentication or user interaction, it poses a significant risk to network security where the device is deployed. The availability of a public exploit increases the likelihood of attempted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, network administrators should consider restricting access to the device's management interface from untrusted networks and monitor for suspicious activity targeting the POST request handler. Applying network-level protections such as firewall rules to limit exposure of the device may reduce risk.