The vulnerability is a classic stack-based buffer overflow triggered by the pppUserName parameter in the formWanTcpipSetup function of the /goform/formWanTcpipSetup POST request handler. An attacker can supply a username longer than the buffer allows, causing a memory overwrite that can lead to arbitrary code execution on the device. This is a high severity issue indexed by CWE-119 and CWE-120.

The affected systems are Edimax BR-6428NS routers running firmware 1.10, as documented in the disclosure. Any device using that specific firmware revision and exposing the formWanTcpipSetup POST endpoint is vulnerable.

The CVSS score of 8.7 indicates a high risk level, and the disclosure notes that an exploit is publicly available and can be launched remotely. The EPSS score is not reported, but the publicly available exploit and lack of vendor response raise concern. Based on the description, the likely attack vector is remote over the router's web management interface: an attacker can send a crafted HTTP POST request to /goform/formWanTcpipSetup from outside the local network. The vulnerability can be exploited without local access and does not require authentication, given the lack of stated restrictions. This risk, coupled with the high CVSS, makes immediate remediation necessary.