CVE-2026-129250 is a critical, remotely triggerable buffer overflow in the formPPTPSetup function of Edimax BR6478ACV2 firmware 1.23; a public exploit exists and the vendor has not responded to the disclosure.
What Is It
CVE-2026-129250 is a buffer overflow in the formPPTPSetup function of the webs component on the Edimax BR6478ACV2 router. An attacker can trigger the overflow by manipulating the pptpUserName argument. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Classic Buffer Overflow).
VulDB is the CNA and reported the issue. The CVE was published to NVD on 2026-11-14 with the status "Deferred."
Why It Matters
VulDB gives the flaw a CVSS 3.1 base score of 9.9 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Remote attack: the attack can be launched over the network.
- Easy to exploit: attack complexity is low and no user interaction is needed.
- Login required: the attacker needs low-level privileges on the device.
- Changed scope: impact can reach beyond the vulnerable component, with high impact to confidentiality, integrity and availability.
The CVSS 4.0 score is 8.6 (High), and its exploit maturity is set to Proof-of-Concept. The CVE description says the exploit "has been disclosed publicly and may be used."
KEV status: No CISA Known Exploited Vulnerabilities entry was supplied for this CVE, so CISA has not confirmed active exploitation. A public exploit lowers the bar for attackers, though, so the risk is still real.
What's Vulnerable
- Vendor: Edimax
- Product: BR6478ACV2
- Affected version: 1.23
- Component:
webs, functionformPPTPSetup, parameterpptpUserName
The source data lists no other affected versions.
Patch Status
No patch has been reported. The CVE record says the vendor "was contacted early about this disclosure but did not respond in any way." The supplied data contains no fixed firmware version, vendor advisory or CISA required action.
Until Edimax responds, administrators running BR6478ACV2 firmware 1.23 should treat the device as vulnerable with no fix available. Because exploitation requires low-level privileges, tightly controlling who can log in to the router lowers exposure but does not fix the flaw.