This vulnerability affects Edimax BR-6428NS firmware version 1.10. The issue lies in the formWanTcpipSetup function within the /goform/formWanTcpipSetup endpoint. By sending a specially crafted POST request that manipulates the pppUserName parameter, an attacker can trigger a buffer overflow condition. The vulnerability is remotely exploitable and does not require user interaction or elevated privileges. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The vendor has not issued any advisory or patch, and the exploit code is publicly available.

Successful exploitation of this vulnerability can lead to a buffer overflow, potentially allowing an attacker to execute arbitrary code remotely on the affected device. This can compromise the confidentiality, integrity, and availability of the router and the network it serves. Given the high CVSS score and remote exploitability, the impact is significant for affected users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting access to the device's management interface from untrusted networks and monitoring for unusual activity. Applying network-level protections such as firewall rules to limit access to the vulnerable endpoint may reduce risk until an official patch is available.