The Edimax BR-6478AC router firmware version 1.23 contains a stack-based buffer overflow vulnerability in the POST request handler function formWanTcpipSetup. Specifically, the pppUserName parameter is not properly validated, allowing an attacker to overflow the stack buffer remotely. This vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Exploitation can lead to high impact on confidentiality, integrity, and availability. Although an exploit is publicly available, there is no vendor-provided patch or official remediation at this time.

Successful exploitation of this vulnerability can result in arbitrary code execution or denial of service on the affected device, compromising the confidentiality, integrity, and availability of the router. Since the attack can be performed remotely without authentication or user interaction, it poses a significant risk to network security where this device is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict network access to the affected device's management interfaces and monitor for any suspicious activity related to POST requests targeting formWanTcpipSetup. Avoid exposing the device directly to untrusted networks.