Which versions of Edimax EW-7478APC are affected by CVE-2026-13564?

An authenticated remote code execution vulnerability in Edimax EW-7478APC access points (firmware 1.04) could allow attackers with low-privilege network credentials to crash WiFi infrastructure or…

How to fix or mitigate CVE-2026-13564?

24 hours: Audit inventory for Edimax EW-7478APC devices running firmware 1.04; catalog which network user accounts have authentication access to these devices. 7 days: Implement network access controls restricting authentication to device management interfaces via firewall rules; segment affected devices from critical systems and sensitive networks. 30 days: Develop and execute device replacement plan for all EW-7478APC units, prioritizing devices in high-value network segments; no firmware updates will resolve this vulnerability.

Edimax EW-7478APC CVE-2026-13564

Q: What is the CVSS score of CVE-2026-13564?

CVE-2026-13564 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-40075 HIGH

Buffer Overflow (CWE-119)

2026-06-29 cna@vuldb.com

GHSA-j79x-62f4-fvpw

Buffer Overflow

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web handler (AV:N) with low complexity, but the formPPPoESetup config endpoint requires low-privilege management access (PR:L); buffer overflow yields full compromise potential, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 12:31 vuln.today

DescriptionCVE.org

A vulnerability was found in Edimax EW-7478APC 1.04. Affected is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. Performing a manipulation of the argument pppUserName results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory via an oversized pppUserName parameter sent to the formPPPoESetup handler at /goform/formPPPoESetup, potentially leading to crash or arbitrary code execution on the device. Publicly available exploit code exists, but there is no public exploit identified as actively used in the wild. The CVSS 4.0 vector indicates network reach with low privileges required (PR:L), and the vendor did not respond to disclosure, so no fix is available.

Technical ContextAI

The affected component is the embedded web management server (goform/CGI handler) of the Edimax EW-7478APC, an 802.11ac wireless access point/range extender. The formPPPoESetup function processes a POST request used to configure PPPoE WAN credentials. The root cause is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer): the pppUserName argument is copied into a fixed-size stack buffer without adequate bounds checking, a pattern typical of C-based CGI handlers on resource-constrained MIPS/ARM SOHO firmware. Overflowing this stack buffer overwrites adjacent stack memory, including saved registers and the return address, which on devices lacking modern mitigations (stack canaries, ASLR, non-executable stack) frequently enables control-flow hijacking.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax was contacted early in the disclosure process but did not respond, so no fixed firmware version exists to cite. As compensating controls, restrict access to the device's HTTP management interface so the /goform/formPPPoESetup endpoint is reachable only from a trusted management VLAN or specific admin host (trade-off: legitimate remote administration is blocked); ensure the management interface is never exposed to the WAN/internet (trade-off: none, this should be standard hardening); enforce strong, unique credentials on the web UI since PR:L exploitation depends on access to the authenticated handler (trade-off: none); and where feasible, replace this end-of-support-style device with a supported access point given the unpatched status. Monitor https://vuldb.com/cve/CVE-2026-13564 for any future vendor response. Do not apply firmware version numbers that have not been confirmed by Edimax.