EUVD-2026-40128
GHSA-9gmf-7v9v-p9h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web UI with low-priv credentials
-
DeliveryCraft POST to /goform/formUSBAccount
-
ExploitSend oversized UserName/Password
-
ExecutionOverflow fixed-size buffer
-
PersistExecute code or crash service
-
ImpactCompromise or DoS access point
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's HTTP management interface and low-privilege authenticated access to it (CVSS PR:L), then sending a POST request to the specific endpoint /goform/formUSBAccount with an oversized UserName or Password argument handled by the formUSBAccount function in the POST Request Handler. The USB account-management feature exposed by this endpoint must be present/reachable in firmware 1.04. Limiting factors: the attacker must already hold valid (even if limited) credentials or a session on the web UI, and the management interface must be network-reachable from the attacker - so the realistic blast radius is largely confined to LAN/management-network adversaries or devices that improperly expose admin over WAN; no end-user interaction is required (UI:N). |
| Impact | Signals are partially aligned. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates network reachability, low complexity, and high confidentiality/integrity/availability impact, but it requires low-level privileges (PR:L) - meaning the attacker needs valid, if limited, credentials or an existing session on the device's web UI, which materially lowers real-world risk versus an unauthenticated flaw. Exploit maturity is E:P (proof-of-concept), and a public POC exists, but this is NOT confirmed active exploitation - the CVE is not in CISA KEV and no EPSS score was provided. The reporter is VulDB (a community/aggregator source) rather than the vendor, and the vendor was unresponsive, so affected-version detail and a patch are unlikely. Net: a genuine, exploitable memory-corruption bug with public POC, but the authentication requirement and niche device footprint make it a moderate, targeted concern rather than a mass-exploitation emergency. Note: EPSS and KEV data are absent from the input and cannot be assumed. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege access to the access point's web interface (e.g., default/weak credentials, a shared management account, or an internal foothold) sends a crafted POST request to /goform/formUSBAccount with an overlong UserName or Password value, overflowing the parameter's fixed buffer to crash the device or execute attacker-controlled code on the firmware. A public proof-of-concept for this exact endpoint is already published, lowering the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Remote buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets an authenticated attacker corrupt memory through the formUSBAccount handler at /goform/formUSBAccount by supplying oversized UserName or Password values in a POST request, enabling likely code execution or device crash. The flaw is remotely reachable and publicly available exploit code exists (proof-of-concept, CVSS 4.0 base 7.4), though there is no public exploit identified as actively used in the wild. The vendor was notified but did not respond, so no fix is expected.
RemediationAI
No vendor-released patch identified at time of analysis - Edimax did not respond to the disclosure, so a fixed firmware version is not available and none should be assumed. As compensating controls: restrict access to the device's web management interface so the /goform/formUSBAccount endpoint is reachable only from a trusted management VLAN or specific admin hosts (block HTTP/HTTPS management ports from the general LAN and especially from any WAN/internet exposure), since the flaw requires reaching the web server; disable the USB account/storage feature if it is not needed, removing the vulnerable functionality; enforce strong, unique administrative credentials and limit the number of accounts, because exploitation needs PR:L privileges, so reducing who holds any web-UI account directly shrinks the attack surface; and consider replacing the device with a vendor-supported model given the unresponsive vendor. Trade-offs: locking down management access complicates remote administration, and disabling USB sharing removes that feature for legitimate users. Monitor VulDB (https://vuldb.com/cve/CVE-2026-13582) for any future fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management interface of the Edimax EW-7478APC (cpe:2.3:a:edimax:ew-7478apc), a SOHO/business wireless access point with a USB account-management feature exposed via the /goform/ CGI-style endpoint formUSBAccount. The root cause is CWE-120 (Classic Buffer Overflow / buffer copy without size checking): the handler copies the attacker-controlled UserName and Password POST parameters into fixed-size stack or global buffers without bounds validation, a common pattern in C-based router firmware where strcpy/sprintf-style routines lack length limits. Overflowing these buffers can overwrite adjacent memory or return addresses on the device's typically MIPS/ARM Linux firmware, leading to denial of service or, depending on memory layout and mitigations (often weak or absent on such devices), arbitrary code execution in the web server's process context.
Know when Ew 7478Apc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N) with simple oversized input (AC:L) but requires a low-privilege web-UI account (PR:L); buffer overflow enables likely code execution, so C/I/A all High.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. This manipulation of the argument UserName/Password causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A remote buffer overflow in Edimax EW-7478APC wireless access points (firmware 1.04) allows authenticated users to corrupt memory and potentially execute code, creating a direct threat to network infrastructure security. With publicly available exploit code and no vendor patch available, organizations using this device face ongoing risk of unauthorized network access and credential compromise until remediated through hardware replacement or compensating controls.
No vendor-released patch identified at time of analysis. Implement: (1) firewall rules restricting access to the /goform/formUSBAccount handler to authorized administrator networks only; (2) require strong authentication (minimum 16-character passwords) on affected device admin accounts; (3) enable and monitor management interface access logs for POST requests containing oversized UserName or Password parameters; (4) network segmentation to isolate affected access points from high-value network segments; (5) disable USB account features at the device level if not operationally critical; (6) establish device replacement roadmap with 90-day target for remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Ew 7478Apc
View allStack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution again
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory by s
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers overflow a buffer b
Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbit
Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS comma
OS command injection in the Edimax EW-7478APC wireless access point firmware 1.04 allows a network-reachable authenticat
Exploit-DB