A buffer overflow condition exists in the formUSBAccount handler of the Edimax BR-6478AC firmware. Manipulation of the UserName or Password argument can trigger an overflow that allows an attacker to execute arbitrary code on the device. The vulnerability is classified as CWE-119 and CWE-120 and has led to the public disclosure of an exploit, indicating that remote attackers can leverage the flaw without additional privileges.

The affected product is the Edimax BR-6478AC router running firmware version 1.23. No other versions or components are listed as impacted.

The CVSS score of 8.7 places this flaw in the high severity range. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit the flaw via a crafted HTTP POST request to the /goform/formUSBAccount endpoint; the endpoint is typically exposed through the router’s web interface, but the description does not explicitly confirm its reachability. The description does not specify whether authentication is required, so the risk of exploitation remains high for both internal and external attackers.