CVE-2026-129250

Edimax BR6478ACV2 critical memory corruption, CVSS 9.9.

A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetup of the file webs. The manipulation of the argument pptpUserName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Start free with one domain How we watch for this

9.9CVSS base score: critical, the highest band

not scoredchance of exploitation in the next 30 days (EPSS)

14 Novfirst published, 2026

Not yeton CISA's exploited list, as of 14 November 2026

Vendor and product	Edimax · BR6478ACV2
Type	memory corruption
Severity	Critical 9.9 CVSS base score
Affected versions	BR6478ACV2: 1.23
First published	14 November 2026
Weakness	Buffer Overflow; Memory Corruption
Exploited	Not confirmed. Critical flaws in Edimax products have been exploited before: Edimax appears on CISA's exploited list.

What to do

Patch before it is exploited

Step 1

Update the product (and every browser or app that embeds it) to the fixed version.

Step 2

Make sure automatic updates are on and actually applied; restart where the update needs it.

Step 3

Watch endpoints for crashes and unusual child processes from the affected software.

Is it on your estate?

Know the day it starts being used

Threat Landscape Monitoring fingerprints the software your internet-facing hosts disclose and tells you the day a vulnerability on them is confirmed exploited, with the host and the fix. The free plan covers one domain.

Start free with one domain

Questions

CVE-2026-129250 in short

Is CVE-2026-129250 being exploited?

Not confirmed as of 14 November 2026: CISA has not added it to its Known Exploited Vulnerabilities catalogue. Critical flaws in Edimax products are a frequent target, so patch before that changes; this page is updated daily.

How severe is CVE-2026-129250?

NVD rates it critical, with a CVSS base score of 9.9.

Which versions of Edimax BR6478ACV2 are affected by CVE-2026-129250?

According to the CVE record: BR6478ACV2: 1.23. Check the vendor's advisory for the fixed version.

How do I fix CVE-2026-129250?

Update the product (and every browser or app that embeds it) to the fixed version. Make sure automatic updates are on and actually applied; restart where the update needs it. Watch endpoints for crashes and unusual child processes from the affected software.

Sources: NVD, the CVE record, FIRST EPSS and the CISA Known Exploited Vulnerabilities catalogue. Page compiled automatically by SAK T.L.M, the threat-intelligence tool of SAK T.E.C, on 14 November 2026.