The Edimax BR-6478AC router version 1.23 contains a buffer overflow vulnerability in the formUSBAccount function located in the /goform/formUSBAccount POST request handler. An attacker can remotely exploit this by manipulating the UserName or Password arguments, leading to a buffer overflow condition. This vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on May 31, 2026, but no official patch or mitigation guidance has been provided by Edimax.

Successful exploitation of this vulnerability allows a remote attacker to cause a buffer overflow by sending specially crafted POST requests to the affected router. This can lead to potential denial of service or arbitrary code execution, impacting the confidentiality, integrity, and availability of the device. The vulnerability affects only version 1.23 of the Edimax BR-6478AC router. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been published by Edimax, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and avoiding exposure to untrusted networks may reduce risk.