EUVD-2026-40071
GHSA-49rv-46ph-6jmv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web interface with PR:L per CVSS 4.0; OS command injection on embedded Linux yields full C/I/A compromise.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in Edimax EW-7478APC 1.04 allows a remote low-privileged attacker to execute arbitrary operating system commands by manipulating the submit-url parameter in POST requests to the /goform/formAccept endpoint. The vendor was notified prior to public disclosure but did not respond, leaving the vulnerability unpatched. A public proof-of-concept exploit has been disclosed, and the CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) appear to significantly understate the realistic impact of OS command injection on an embedded network device, which typically yields full system control.
Technical ContextAI
The Edimax EW-7478APC is a consumer/SOHO Wi-Fi access point running firmware version 1.04. Its web management interface exposes a CGI-style handler at /goform/formAccept, processed by the C function formAccept. The submit-url POST parameter is passed to a system-level command execution context without adequate sanitization or escaping, satisfying CWE-77 (Improper Neutralization of Special Elements used in a Command). Embedded devices in this class typically run a BusyBox/uClibc Linux environment as root, meaning injected commands execute with the highest system privileges. No CPE strings were provided in the source data, but the affected product is inferred as the Edimax EW-7478APC hardware running firmware 1.04.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to the coordinated disclosure. As a primary compensating control, restrict access to the device's web management interface by placing the device behind a firewall that blocks inbound access to its HTTP management port (typically TCP 80/443) from untrusted networks - this prevents remote exploitation since the attack requires reaching the /goform/formAccept endpoint. If management access must be retained, limit it to specific trusted IP addresses using firewall ACLs or the device's built-in access control features. Disabling remote web management entirely, if the device supports it, eliminates the attack surface at the cost of losing remote administration capability. Network segmentation (placing the device on an isolated management VLAN) reduces lateral movement risk if the device is compromised. Monitor VulDB entry 374568 and the Edimax product page for any future firmware updates.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today