Edimax EW-7478APC CVE-2026-19960

Exploitation requires low-privilege authenticated access to the Edimax EW-7478APC web management interface, confirmed by the CVSS PR:L metric - unauthenticated attackers cannot directly exploit this vulnerability. The attacker must be able to reach the device's management interface over the network (AV:N), meaning the management port must be accessible from the attacker's network position. No user interaction beyond the attacker's own HTTP request is required (UI:N), and no special non-default configuration is indicated. Limiting factors include: the requirement for valid (even low-privilege) credentials, and network segmentation that places the management interface on an isolated VLAN or behind firewall rules blocking untrusted access. Devices with management access restricted exclusively to a trusted internal network are substantially less exposed than those with internet-facing or broadly accessible management interfaces.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is network-reachable with low complexity and requires only low-privilege credentials, meaning any authenticated user of the management interface can trigger it without further preconditions. The official CVSS 4.0 score of 5.3 rates impact conservatively as Low across all categories (VC:L/VI:L/VA:L), which likely understates the real-world impact of arbitrary OS command execution on an embedded network device - a discrepancy that defenders should flag, as command injection on router/AP firmware commonly yields full root-level control. The E:P (Exploit:Proof-of-Concept) modifier in the provided vector confirms public exploit code exists, a signal that raises urgency beyond the base score alone. This CVE does not appear in CISA KEV, so mass active exploitation is not confirmed, though the public PoC dramatically shortens the attacker ramp-up time; even a mid-sized municipal IT team in tczew managing a campus wireless infrastructure should treat this as urgent given the trivial replication effort. No EPSS data was provided. With no vendor patch and no vendor engagement, the risk posture for any organization operating this device on a reachable management interface is persistently elevated.

An attacker with low-privilege authenticated access to the Edimax EW-7478APC web management interface submits a crafted HTTP request to /goform/formWlbasic with a rootAPmac parameter value containing shell metacharacters (e.g., semicolons or backticks). Because the firmware's formWlbasic handler does not sanitize this input before passing it to an OS command, the injected commands execute in the context of the web server or underlying system process. With a public proof-of-concept available on Notion (linked from VulDB), the attack requires minimal adaptation and can be replicated by any attacker who can authenticate to the management interface.