This vulnerability affects Edimax BR-6478AC version 1.23 and involves a buffer overflow in the formUSBAccount function located in the /goform/formUSBAccount POST request handler. An attacker can remotely send crafted UserName or Password arguments to overflow a buffer, potentially leading to arbitrary code execution or denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official patch or fix has been published by the vendor as of the information available.

Successful exploitation of this vulnerability could allow a remote attacker to cause a buffer overflow, which may result in arbitrary code execution or denial of service on the affected device. This could compromise the integrity and availability of the router. The vulnerability is exploitable remotely without authentication or user interaction, increasing its risk. However, there are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting network exposure of the affected device, such as restricting access to the management interface from untrusted networks. Monitor vendor communications for updates on patches or mitigations. No vendor advisory or official fix has been published yet.