CVE-2026-10125

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1012587.8A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execut CVE-2026-101268.8A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of CVE-2026-1012609.1A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/CVE-2026-1012619.1A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a ma CVE-2026-1012629.1A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_clie CVE-2026-1012639.1A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client CVE-2026-1012649.1A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This ma CVE-2026-1012653.1A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page CVE-2026-1012661.3A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.CVE-2026-1012672.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some spe CVE-2026-1012681.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the CVE-2026-1012692.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used