Cyber Posture

CVE-2024-48416

HighPublic PoC

Published: 27 January 2025

Published
27 January 2025
Modified
28 May 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0018 39.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2024-48416 is a buffer overflow vulnerability (CWE-120) in the Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC version 1.06. The flaw is exploitable through the web management interface endpoint /goform/fromSetLanDhcpsClientbinding, which fails to properly handle input lengths, leading to potential memory corruption.

Attackers on an adjacent network (AV:A) can exploit this vulnerability with low complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N). Exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 8.8, enabling outcomes such as arbitrary code execution, data manipulation, or device crashes.

Advisories providing mitigation guidance, including potential patches or workarounds, are available from the vendor at http://edimax.com and in the detailed GitHub advisory at https://github.com/SpikeReply/advisories/blob/c271ddb997bc0263274118acc380bc71ce9c316b/cve/edimax/cve-2024-48416.md. Security practitioners should review these resources promptly for affected systems.

Details

CWE(s)
CWE-120

Affected Products

edimax
br-6476ac firmware
1.06

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Buffer overflow in the router's web management interface (/goform/fromSetLanDhcpsClientbinding) enables remote code execution through exploitation of a public-facing application or remote service.

References