This vulnerability affects Edimax BR-6428NS firmware version 1.10. It arises from a buffer overflow condition in the formPPTPSetup function located in the /goform/formPPTPSetup POST request handler. Specifically, manipulation of the pptpUserName parameter can overflow a buffer, potentially allowing remote code execution or denial of service. The vulnerability requires no user interaction and can be triggered over the network. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not issued a patch or advisory, and remediation status is unknown.

Successful exploitation could allow an unauthenticated remote attacker to cause a buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. This could compromise the confidentiality, integrity, and availability of the router. No known active exploitation has been reported, but public exploit code is available, increasing the risk of future attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting network access to the affected device, disabling PPTP services if possible, or replacing the device with a secure alternative. Monitor vendor channels for any forthcoming patches or updates.