CVE-2026-10165 HIGH

CVE-2026-10165: Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow

Vendor Edimax

Product BR-6478AC

Weakness CWE-121

Published May 31, 2026

Last update June 1, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in Edimax BR-6478AC 1.23. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used.

Key dates

02Disclosure timeline

May 31, 2026 CVE published

June 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-10165 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2021-34980 CVE-2025-2369 TOTOLINK EX1800T cstecgi.cgi setPasswordCfg stack-based overflow CVE-2023-37326 D-Link DAP-2622 DDP Set Wireless Info Auth Password Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-39853 osslsigncode has a Stack Buffer Overflow via Unbounded Digest Copy During Signature Verification CVE-2021-1175 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities