CVE-2023-49351 is a critical stack-based buffer overflow, scored 9.8, in the web server of Edimax BR6478AC V2 firmware v1.23. The record names no fixed version, so check Edimax for an update and keep the router's admin interface off the internet.
What's affected
The record says the stack-based buffer overflow is in the /bin/webs binary of Edimax BR6478AC V2 firmware v1.23 and comes from an incorrect use of the strcpy function, which lets attackers overwrite other values on the stack. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The only reference is a researcher write up on GitHub. I did not fetch it, because it is not a vendor advisory and the record already carries the facts needed. No fixed version appears in the record, so I cannot name one.
How to check if you're exposed
Log in to the router's management page and read the firmware version. The record names v1.23 on hardware revision V2. If yours matches, it is in the affected set.
The hardware revision matters, so confirm the label on the device says BR6478AC V2 and not another revision.
What to do now
- Find every Edimax BR6478AC V2 in use and read its firmware version.
- Check Edimax's support site for a firmware newer than v1.23. The record does not name a fix, so do not assume one exists.
- Turn off remote administration and make sure the web management port is not exposed to the internet.
- If no update exists, plan to replace the router, since a memory corruption bug in the web server is hard to mitigate by configuration.
- Log the decision and the date so the device is revisited when a vendor note appears.
Why it matters
The weakness is an out-of-bounds write, CWE-787. The function strcpy copies a string until it finds a terminator and never checks the destination size, so oversized input overwrites neighbouring stack memory.
The web server on a router runs with high privileges and listens on the network, so a memory bug there is rated critical. KEV status is false for this CVE, so this post does not claim exploitation in the wild.
For a defender with a fleet of consumer grade routers, the practical question is lifecycle. Ask whether the vendor still ships firmware for this model. If not, the device is a standing risk, and replacement is cheaper than the incident it would cause. Segment management traffic, and log administrative access where the device allows it.
Quick check
Why does strcpy cause overflows?
It copies without knowing the size of the destination buffer. If the input is longer than the buffer, the extra bytes overwrite adjacent memory.
Sources
Researcher write up referenced by NVD (not fetched)
Last reviewed: 19 October 2026.
