Which versions of Edimax EW-7478APC are affected by CVE-2026-13580?

The Edimax EW-7478APC wireless access point (firmware 1.04) contains a remotely exploitable buffer overflow vulnerability (CVE-2026-13580, CVSS 7.4) that allows attackers to crash the device or…

Is there a public PoC exploit available for CVE-2026-13580?

Yes, a public proof-of-concept exploit is available for CVE-2026-13580. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-13580?

Within 24 hours: inventory all Edimax EW-7478APC devices running firmware 1.04 and restrict management interface access to trusted networks only. Within 7 days: execute replacement with alternative access point models from vendors with active security support; implement firewall rules blocking POST requests to /goform/formQoS with suspicious selSSID parameters. Within 30 days: complete decommissioning of all affected Edimax devices and validate network monitoring detects exploitation attempts.

Edimax EW-7478APC CVE-2026-13580

Q: What is the CVSS score of CVE-2026-13580?

CVE-2026-13580 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40124 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-29 VulDB

GHSA-jv8x-v9mq-9q74

Buffer Overflow Ew 7478Apc

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable management handler with low complexity but requiring an authenticated low-privilege session (PR:L); overflow in a privileged firmware process yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 16:31 vuln.today

CVSS changed

Jun 29, 2026 - 16:22 NVD

8.7 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers overflow a buffer by manipulating the selSSID parameter in a POST request to the /goform/formQoS endpoint, potentially crashing the device or executing code on it. The flaw is network-reachable and publicly available exploit code exists (disclosed via VulDB and a Notion writeup), but it is not listed in CISA KEV and no active exploitation has been confirmed. The vendor was notified but did not respond, and no patched firmware has been published.

Technical ContextAI

The EW-7478APC is an Edimax AC1200 Gigabit PoE wireless access point whose web management interface uses 'goform' CGI-style handlers to process configuration POST requests. The vulnerable function formQoS handles Quality-of-Service settings; the selSSID argument it receives is copied into a fixed-size buffer without adequate bounds checking - the classic CWE-120 (Classic Buffer Overflow / unbounded copy) root cause common in embedded MIPS/ARM router firmware that relies on unsafe C string routines such as strcpy/sprintf. Because such handlers typically run with high privilege in the device firmware, a controllable overflow can corrupt adjacent stack memory or a return address. The single CPE supplied, cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:*, identifies the affected product but pins no specific fixed version.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond, so there is no fixed firmware version to cite. As the highest-value compensating control, restrict access to the device's web management interface to a trusted management VLAN or specific admin host via firewall/ACL so the /goform/formQoS endpoint is unreachable from general user or untrusted networks; the trade-off is slightly more complex remote administration. Disable remote/WAN-side management entirely if it is enabled, since that removes internet exposure of the vulnerable handler. Change default, weak, or reused management credentials and tightly limit who holds the low-privilege account needed to reach formQoS, because exploitation requires authentication (PR:L). Monitor the access point for unexpected reboots or crashes as a sign of attempted exploitation, and if the device is end-of-life or unsupported, plan replacement with a vendor-supported access point. Track updates via the VulDB advisory at https://vuldb.com/vuln/374586.