Edimax BR-6208AC Buffer Overflow Vulnerability

A buffer overflow vulnerability, CVE-2026-7685, has been identified in Edimax BR-6208AC routers up to version 1.02. The vulnerability resides within the /goform/setWAN file, specifically related to the pptpDfGateway argument. Successful exploitation of this flaw could allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Publicly available exploits exist, increasing the risk of widespread exploitation. The vendor was notified but has not responded. Given the ease of exploitation and the potential for significant impact, this vulnerability poses a critical threat to affected devices.

Attack Chain

1. Attacker identifies an Edimax BR-6208AC router with firmware version 1.02 or earlier exposed to the internet.
2. The attacker crafts a malicious HTTP POST request targeting the /goform/setWAN endpoint.
3. Within the POST request, the attacker includes the pptpDfGateway argument, injecting a payload exceeding the buffer’s expected size.
4. The router’s web server processes the malicious request without proper input validation on the size of the pptpDfGateway argument.
5. The oversized payload overwrites adjacent memory regions on the stack, potentially including return addresses or other critical data.
6. When the function attempts to return, it jumps to an address controlled by the attacker, leading to arbitrary code execution.
7. The attacker executes commands to gain control of the device, potentially installing malware or modifying router settings.

Impact

Successful exploitation of this vulnerability can lead to complete compromise of the Edimax BR-6208AC router. An attacker could leverage this access to perform a variety of malicious activities, including eavesdropping on network traffic, injecting malicious code into web pages served by the router, or using the router as a bot in a larger botnet. Given the availability of public exploits, unpatched devices are at immediate risk of compromise.

Recommendation

• Deploy the Sigma rule Detect Edimax BR-6208AC setWAN Buffer Overflow Attempt to identify exploitation attempts in web server logs.
• Inspect web server logs for POST requests to /goform/setWAN containing unusually long pptpDfGateway parameters, as detected by the Sigma rule Detect Long pptpDfGateway Parameter.
• Apply appropriate network segmentation to limit the blast radius of compromised devices and prevent lateral movement.