CVE-2024-48416
Published: 27 January 2025
Summary
CVE-2024-48416 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Edimax Br-6476Ac Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-48416 is a buffer overflow vulnerability (CWE-120) in the Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC version 1.06. The flaw is exploitable through the web management interface endpoint /goform/fromSetLanDhcpsClientbinding, which fails to properly handle input lengths, leading to potential memory corruption.
Attackers on an adjacent network (AV:A) can exploit this vulnerability with low complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N). Exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 8.8, enabling outcomes such as arbitrary code execution, data manipulation, or device crashes.
Advisories providing mitigation guidance, including potential patches or workarounds, are available from the vendor at http://edimax.com and in the detailed GitHub advisory at https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48416.md. Security practitioners should review these resources promptly for affected systems.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43238
Vulnerability details
Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 is vulnerable to Buffer Overflow via /goform/fromSetLanDhcpsClientbinding.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the router's web management interface (/goform/fromSetLanDhcpsClientbinding) enables remote code execution through exploitation of a public-facing application or remote service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow exploitation by enforcing input validation mechanisms at the vulnerable /goform/fromSetLanDhcpsClientbinding web endpoint to check lengths and reject malformed inputs.
Requires timely identification, reporting, and patching of the specific buffer overflow flaw in Edimax BR-6476AC firmware version 1.06 as advised by vendor resources.
Implements memory protections such as ASLR and stack canaries to mitigate arbitrary code execution from buffer overflow memory corruption even if input validation is bypassed.