An over‑read/over‑write flaw exists in the POST request handler of the Edimax BR‑6675nD firmware version 1.12, specifically the formsetPPPoE function that processes the pppUserName parameter. The vulnerability is classified as a buffer overflow (CWE‑119, CWE‑120) and can be triggered by sending a crafted POST request to the /goform/formsetPPPoE endpoint. The flaw allows an attacker to corrupt memory, potentially execute arbitrary code or crash the device, compromising confidentiality, integrity, and availability. The exploit is publicly available and the vendor has not released a fix.}

The affected system is the Edimax BR‑6675nD router running firmware version 1.12. The primary attack surface is the exposed web management interface that processes PPPoE configuration via POST requests. Any device running this firmware revision and exposed to an untrusted network may be susceptible; newer or unconfirmed firmware revisions are not identified as affected.

The CVSS score of 8.7 indicates a high severity. Although the EPSS score is not available, the publicly available exploit indicates a realistic threat. The vulnerability is not listed in CISA’s KEV catalog, but the lack of vendor responsiveness does not mitigate the risk. The likely attack vector is remote network traffic: an attacker can send a crafted HTTP POST to the router’s web interface without authentication, triggering the overflow. The exploit does not require privileged access beyond network reachability.