Which versions of Edimax EW-7478APC are affected by CVE-2026-13582?

A remote buffer overflow in Edimax EW-7478APC wireless access points (firmware 1.04) allows authenticated users to corrupt memory and potentially execute code, creating a direct threat to network…

Is there a public PoC exploit available for CVE-2026-13582?

Yes, a public proof-of-concept exploit is available for CVE-2026-13582. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-13582?

Within 24 hours: Inventory all Edimax EW-7478APC devices; confirm affected firmware version 1.04; restrict administrative access to the device management interface to authorized networks only. Within 7 days: Implement network segmentation isolating affected access points from critical assets; require VPN authentication for all remote management; disable USB account features if operationally unnecessary. Within 30 days: Plan and execute replacement with vendor-supported wireless access point models or establish end-of-life timeline for affected devices.

Edimax EW-7478APC CVE-2026-13582

Q: What is the CVSS score of CVE-2026-13582?

CVE-2026-13582 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40128 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-29 VulDB

GHSA-9gmf-7v9v-p9h8

Buffer Overflow Ew 7478Apc Edimax

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N) with simple oversized input (AC:L) but requires a low-privilege web-UI account (PR:L); buffer overflow enables likely code execution, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 16:31 vuln.today

CVSS changed

Jun 29, 2026 - 16:22 NVD

8.7 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. This manipulation of the argument UserName/Password causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets an authenticated attacker corrupt memory through the formUSBAccount handler at /goform/formUSBAccount by supplying oversized UserName or Password values in a POST request, enabling likely code execution or device crash. The flaw is remotely reachable and publicly available exploit code exists (proof-of-concept, CVSS 4.0 base 7.4), though there is no public exploit identified as actively used in the wild. The vendor was notified but did not respond, so no fix is expected.

Technical ContextAI

The affected component is the embedded web management interface of the Edimax EW-7478APC (cpe:2.3:a:edimax:ew-7478apc), a SOHO/business wireless access point with a USB account-management feature exposed via the /goform/ CGI-style endpoint formUSBAccount. The root cause is CWE-120 (Classic Buffer Overflow / buffer copy without size checking): the handler copies the attacker-controlled UserName and Password POST parameters into fixed-size stack or global buffers without bounds validation, a common pattern in C-based router firmware where strcpy/sprintf-style routines lack length limits. Overflowing these buffers can overwrite adjacent memory or return addresses on the device's typically MIPS/ARM Linux firmware, leading to denial of service or, depending on memory layout and mitigations (often weak or absent on such devices), arbitrary code execution in the web server's process context.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure, so a fixed firmware version is not available and none should be assumed. As compensating controls: restrict access to the device's web management interface so the /goform/formUSBAccount endpoint is reachable only from a trusted management VLAN or specific admin hosts (block HTTP/HTTPS management ports from the general LAN and especially from any WAN/internet exposure), since the flaw requires reaching the web server; disable the USB account/storage feature if it is not needed, removing the vulnerable functionality; enforce strong, unique administrative credentials and limit the number of accounts, because exploitation needs PR:L privileges, so reducing who holds any web-UI account directly shrinks the attack surface; and consider replacing the device with a vendor-supported model given the unresponsive vendor. Trade-offs: locking down management access complicates remote administration, and disabling USB sharing removes that feature for legitimate users. Monitor VulDB (https://vuldb.com/cve/CVE-2026-13582) for any future fix.