CVE-2026-7684
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability has been detected in Edimax BR-6428nC up to version 1.16, affecting an unknown function of the file /goform/setWAN. Manipulation of the argument pptpDfGateway leads to buffer overflow.
Risk Assessment
The attack can be launched remotely, posing a serious threat to the security of the device and the network. The public disclosure of the exploit increases the risk of its use.
Recommendation
It is recommended to update the device to the latest firmware version to mitigate this vulnerability. Additionally, monitor network traffic for potential attack attempts.
Other vulnerabilities in Edimax BR-6428nC
See all- CVE-2026-100745Medium
A vulnerability in the Edimax BR-6428nC router version 1.16 affects an unknown function in the file /goform/formWizSurvey of the Wireless Wizard Handler component. Manipulation of the interface1/interface2 arguments leads to a stack-based buffer overflow. Remote exploitation is possible, and the exploit has been publicly disclosed.
- CVE-2026-96892Medium
A flaw in Edimax BR-6428nC 1.16. The websRedirect function of the goform Handler improperly handles the submit-url argument, leading to open redirect. The attack can be launched remotely. The exploit has been published.
- CVE-2026-7683Medium
In the Edimax BR-6428nC router up to version 1.16, manipulation of the pppUserName/pptpUserName argument in the /goform/setWAN file of the web interface leads to command injection. The attack can be initiated remotely, and a public exploit is available that could be used in attacks. The vendor was contacted early but did not respond.
Original NVD description (English source)
A security vulnerability has been detected in Edimax BR-6428nC up to 1.16. This impacts an unknown function of the file /goform/setWAN. Such manipulation of the argument pptpDfGateway leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS