The flaw resides in the formPPPoESetup handler of the Edimax BR-6478AC firmware version 1.23. An attacker can supply a crafted pppUserName value that overflows a stack buffer, potentially allowing the execution of arbitrary code on the device. The vulnerability is a classic stack‑based buffer overflow (CWE‑119 and CWE‑121). Since the exposure is through a POST request that is reachable from the Internet, the impact can be catastrophic, granting remote attackers full control over the router.

Edimax BR‑6478AC routers running firmware 1.23 are affected. No other firmware versions or product variants are listed as vulnerable.

The CVSS score of 8.7 indicates a high severity and a full attack path from a remote host. The EPSS score is not available, so the current statistical exploitation probability cannot be quantified, but a publicly available exploit has already been described, implying a likely exploitation window. The vulnerability is not yet listed in the CISA KEV catalog, however the existence of an exploit code and remote trigger make it a serious concern. The attack vector is inferred to be remote, via an HTTP POST to the /goform/formPPPoESetup endpoint, as documented in the advisory.