A buffer overflow occurs in the formPPTPSetup function of the Edimax BR-6428NS router firmware 1.10 when an attacker manipulates the pptpUserName argument of a POST request to the /goform/formPPTPSetup endpoint. The overflow can corrupt memory and, based on the nature of buffer overflows, may lead to arbitrary code execution or a system crash. The description states that the attack can be launched remotely, implying no local privileges are required and that the vulnerable endpoint is reachable over the network.

The affected system is the Edimax BR-6428NS router running firmware version 1.10. No other versions are explicitly listed as vulnerable in the data provided.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the fact that an exploit has been publicly disclosed and can be triggered remotely raises the likelihood of exploitation. Attackers can send malicious POST requests to the router’s HTTP interface to exploit the buffer overflow. In the absence of an official patch, the risk remains high until remediation steps are applied.