Edimax EW-7478APC CVE-2026-19959

Exploitation requires network access to the Edimax EW-7478APC web management interface and a valid low-privilege authenticated session (PR:L per the CVSS 4.0 vector). The specific vulnerable entry point is the WAN TCP/IP configuration form at /goform/formWanTcpipSetup, triggered via manipulation of the pppUserName POST parameter - this endpoint is only reachable when the device's HTTP management server is accessible. No user interaction is required beyond the attacker submitting the crafted request. Limiting factors: authentication is required (PR:L), which prevents fully unauthenticated exploitation - however, SOHO devices frequently use default or weak credentials that trivialize this barrier. Exploitation scope is further limited to devices where the management interface is reachable by the attacker, either on the local LAN or via WAN-side remote management if that feature is enabled. Firmware version 1.04 is confirmed vulnerable; behavior on other versions is unknown.

The CVSS 4.0 score of 8.6 (High) reflects a network-accessible, low-complexity vulnerability requiring low privileges with high impact across both vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The E:P modifier confirms a public exploit exists, which materially elevates real-world risk. No EPSS data was provided in the input. The PR:L requirement - meaning some authenticated session is needed - is the primary limiting factor preventing fully opportunistic mass exploitation, though SOHO devices with default or weak credentials frequently have this barrier trivialized. KEV status has not been confirmed, so active exploitation cannot be asserted; however, the public POC lowers the attacker skill requirement significantly. The vendor's non-response to disclosure means no patch is forthcoming on any known timeline, leaving defenders with only compensating controls. The CVSS 4.0 subsequent-system impact scores (SC:H/SI:H/SA:H) accurately reflect that a fully compromised router/AP threatens all downstream network traffic, enabling interception and manipulation of connected clients. The combination of public exploit, no patch, and a vendor who is unresponsive makes this a real priority for any organization with this device deployed.

An attacker with low-privilege credentials to the EW-7478APC management interface sends a crafted HTTP POST request to /goform/formWanTcpipSetup with a pppUserName value far exceeding the expected buffer length. The oversized input overflows the fixed stack buffer in formWanTcpipSetup, overwriting the return address and redirecting execution to attacker-controlled code running in the device's firmware context - granting full control over the access point. A public proof-of-concept is documented at a Notion page linked in the VulDB entry, reducing the technical barrier to exploitation to script-level capability.