The vulnerability resides in the formiNICSiteSurvey function within the POST Request Handler of Edimax BR-6478AC firmware 1.23. Maliciously manipulating the selSSID parameter causes a buffer overflow, allowing an attacker to overwrite memory and potentially execute arbitrary code. The flaw can be triggered remotely via a crafted HTTP POST request, so an adversary without local access can exploit it, resulting in full compromise of the device.

Affected systems are Edimax BR-6478AC routers running firmware version 1.23. No other versions are listed in the CNA data. The device is a consumer‑grade Wi‑Fi access point, and the vulnerability is tied to a single web interface endpoint.

The CVSS score of 8.7 signals a high severity risk, and although an EPSS score is not available, the exploit has already been published online. The vulnerability is not listed in CISA KEV, but the lack of vendor response and publicly available exploit code amplify the potential impact. Attackers could use this flaw through any network that can reach the router’s web interface, and the absence of hardening steps makes the device especially vulnerable.