Edimax EW-7478APC CVE-2026-13580

Exploitation requires the attacker to reach the EW-7478APC HTTP management interface over the network and send a POST request to the /goform/formQoS handler with an oversized selSSID argument; the CVSS vector's PR:L indicates a low-privilege authenticated session to the management UI is needed, so this is not exploitable by a fully unauthenticated outsider against a default deployment. Limiting factors that reduce realistic risk: the attacker must have network reachability to the management interface (typically the LAN/management side, not the internet unless remote management is exposed) and must hold valid low-privilege credentials. No user interaction is required (UI:N) and attack complexity is low (AC:L). The affected configuration is the EW-7478APC running firmware 1.04 with the web QoS configuration handler present.

The supplied CVSS 4.0 score is 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H), no subsequent-system impact, and exploit maturity E:P (proof-of-concept). The key limiting signal is PR:L: exploitation requires an authenticated low-privilege session on the management interface, which materially lowers real-world risk versus a fully unauthenticated network bug. Publicly available exploit code exists, but the issue is NOT in CISA KEV and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred - treat this as a PoC-available, authenticated, network-reachable flaw rather than a mass-exploited threat. The high CVSS impact is plausible given privileged firmware handlers, but whether the overflow yields reliable code execution versus only a denial-of-service crash is not established in the available data and should be verified against the PoC.

An attacker who has obtained low-privilege access to the access point's web interface - for example via default, weak, or reused credentials on a reachable management network - sends a crafted POST request to /goform/formQoS with an oversized selSSID value, overflowing the handler's buffer to crash the device or attempt code execution as the firmware's privileged process. A public proof-of-concept for this exact endpoint exists, lowering the effort required to reproduce the attack.