This vulnerability involves a buffer overflow triggered by manipulating the L2TPUserName parameter in the formL2TPSetup function of the Edimax BR-6478AC router firmware version 1.23. The flaw exists in the POST request handler component, allowing remote attackers to potentially execute arbitrary code or cause denial of service. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not provided any official fix or response despite early contact, and no patch links are available. Exploit code has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation can lead to remote code execution or denial of service on the affected device, compromising confidentiality, integrity, and availability. The vulnerability requires no user interaction and can be triggered remotely, making it a significant risk for affected devices running firmware version 1.23. There is no indication of known exploits in the wild yet, but public disclosure of the exploit increases the likelihood of attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by disabling the vulnerable service if possible, restricting network access to the device, or replacing the device with a non-affected model until an official patch is available.