CVE-2026-9443

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

A security vulnerability has been detected in Edimax BR-6478AC 1.23. This vulnerability affects the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. The manipulation of the argument L2TPUserName leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-944325.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec CVE-2026-944397.5When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server impro CVE-2026-94444.7A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admi CVE-2026-944407.5Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a p CVE-2026-944447.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY th CVE-2026-944458.8A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Dis CVE-2026-944477.8Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a maliciou CVE-2026-944486.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new e CVE-2026-944497.5A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers f CVE-2026-94456.3A flaw has been found in SourceCodester Simple POS and Inventory System 1.0. Impacted is an unknown function of the file /admin/addproduct.p CVE-2026-944507.5Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause CVE-2026-944516.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoint