This vulnerability affects Edimax BR-6428NS version 1.10 in the POST request handler component, specifically the formL2TPSetup function. By sending a specially crafted POST request manipulating the L2TPUserName parameter, an attacker can trigger a buffer overflow condition. The vulnerability is remotely exploitable without requiring user interaction or privileges. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction. The vendor has not issued a patch or advisory, and the exploit code is publicly available.

Successful exploitation of this buffer overflow vulnerability could allow remote attackers to cause a denial of service or potentially execute arbitrary code on the affected device. Given the high CVSS score and remote exploitability, this poses a significant risk to the confidentiality, integrity, and availability of the device. The lack of vendor response and patch increases the risk for users of the affected firmware version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by disabling the vulnerable service if possible, restricting network access to the device, or replacing the device with a non-affected model. Monitor official Edimax channels for any future updates or patches.