The vulnerability is a classic buffer overflow in the Edimax BR‑6675nD firmware, triggered by the pppUserName parameter passed to the formWanTcpipSetup function in the POST request handler. The overflow can be leveraged to corrupt memory and execute arbitrary code, compromising confidentiality, integrity, or availability of the device. It directly maps to CWE‑119 and CWE‑120 weaknesses. The impact is that an attacker can gain full control over the router, potentially exfiltrating data, hijacking traffic, or using the device to pivot to other parts of the network.

Vulnerable devices are Edimax BR‑6675nD routers running firmware version 1.12. No other versions or models were explicitly listed, so the risk is confined to that release. The product is exposed via the /goform/formWanTcpipSetup POST interface.

The CVSS score of 8.7 marks this a high‑severity flaw. No EPSS score is available, but the attack vector is remote, and the exploit is publicly disclosed, indicating a high likelihood of real‑world exploitation. The vulnerability is not yet listed in CISA’s KEV catalog, but that status may evolve. Given that the vendor did not respond to the disclosure, no official fix exists at present, making remediation the top priority. The risk escalates if the device remains exposed to the Internet or to untrusted users.