The firmware of the Edimax BR‑6428NS includes a buffer overflow within the POST Request Handler for the formWirelessTbl endpoint. Manipulating the vapurl argument places data beyond the bounds of a fixed memory region, which is identified as a classic memory safety flaw under CWE‑119 and CWE‑120. If exploited, the overflow can allow an attacker to overwrite control data and potentially execute arbitrary code, which is tantamount to a remote code execution.

The only affected version listed is the 1.10 firmware of the Edimax BR‑6428NS. No other versions are recorded in the CNA data and the entire device model Edimax BR‑6428NS is implicated.

The CVSS score of 8.7 signifies a high severity vulnerability. EPSS data is not available, but the presence of a publicly available exploit implies that the risk of an attack is real. The vulnerability can be triggered remotely through a crafted POST request, with no authentication or local privilege needed, which makes it highly attractive to attackers. The device is currently listed outside the CISA KEV catalog, but the public nature of the exploit demands urgent attention.