A critical security vulnerability (CVE-2026-10126) has been discovered in Edimax BR-6478AC router firmware version 1.23. The vulnerability affects the formQoS function in the /goform/formQoS file of the POST Request Handler component. An attacker can exploit this flaw by manipulating the selSSID argument, which leads to a buffer overflow condition. The vulnerability can be exploited remotely, making it particularly dangerous. A public exploit has been released and is available for use in attacks, significantly increasing the risk to affected devices. This vulnerability poses a high security risk due to its remote exploitability and the availability of public exploit code.