The Edimax BR-6478AC router firmware version 1.23 contains a stack-based buffer overflow vulnerability in the formPPPoESetup function of the POST Request Handler component. Specifically, the vulnerability arises from improper validation of the pppUserName argument, allowing an attacker to remotely trigger a buffer overflow condition. This can potentially lead to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploit code is publicly available, increasing the risk of exploitation, although no active exploitation has been confirmed. No official patch or vendor advisory detailing remediation is currently available.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow on the affected device, potentially leading to arbitrary code execution or denial of service. Given the network attack vector and no required privileges or user interaction, the vulnerability poses a significant risk to affected devices. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by Edimax, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and disabling remote administration features, if possible, may reduce exposure.