Field brief
Edimax BR 6478AC V2 buffer overflow CVE-2026-129250
Critical buffer overflow in Edimax BR 6478AC V2 firmware 1.23, no patch yet, monitor for exploitation.
A critical buffer‑overflow vulnerability (CVE‑2026‑129250) was disclosed on 14 Nov 2026 in Edimax BR 6478AC V2 firmware 1.23. The flaw lies in the formPPTPSetup function of the webs file, where an attacker can manipulate the pptpUserName argument to overflow a buffer and gain remote control. CVSS 9.9 marks it as critical, yet no patch has been released and the vulnerability is not listed in CISA’s KEV catalog. The NVD entry confirms the CVSS score and provides additional details. With no public exploit yet, the risk remains theoretical, but the high severity warrants immediate attention. Users of the affected device should verify firmware version, apply any future vendor patch, and monitor for signs of exploitation. No vendor patch has been released, so users should keep firmware up to date when available. Until a fix arrives, consider disabling the PPTP service or restricting access to the web interface. CVE‑2026‑129250
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.