High severity · published May 30, 2026
CVE-2026-10126
Edimax BR-6478AC POST Request formQoS buffer overflow
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
BR-6478AC · Edimax
1.23 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10126
lavender-bicycle-a5a.notion.site
https://lavender-bicycle-a5a.notion.site/EDIMAX-BR6478ACV2-formQoS-34b53a41781f804e9ddfe771c426d9b2?source=copy_link
vuldb.com
https://vuldb.com/submit/818454
vuldb.com
https://vuldb.com/vuln/367303
vuldb.com
https://vuldb.com/vuln/367303/cti
More from BR-6478AC
9.8
CVE-2023-49351
A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located on the stack due to…
8.8
CVE-2026-10165
Edimax BR-6478AC POST Request formWanTcpipSetup stack-based overflow
8.8
CVE-2026-10164
Edimax BR-6478AC POST Request formUSBFolder buffer overflow
8.8
CVE-2026-10163
Edimax BR-6478AC POST Request formUSBAccount buffer overflow
8.8
CVE-2026-10125
Edimax BR-6478AC POST Request formPPPoESetup stack-based overflow