Edimax EW-7478APC CVE-2026-19962

The /goform/setWAN management endpoint must be network-reachable by the attacker - this is typically the device's LAN-side or management-side web interface, not necessarily exposed to the internet unless remote management is enabled. The CVSS 4.0 PR:L metric confirms that low-privilege authentication is required; the attacker must supply valid credentials to the device web interface before the vulnerable endpoint can be reached. The vulnerability is triggered specifically through the WAN credential input fields: pppUserName (PPPoE), pptpUserName (PPTP), or L2TPUserName (L2TP) - meaning at least one of these WAN protocol modes must be accessible in the configuration form. Exploitation is limited by the authentication requirement, meaning unauthenticated drive-by exploitation is not supported by the CVSS data. However, Edimax consumer devices commonly ship with default credentials, making credential-based access a realistic attacker precondition in many deployments.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/E:P) indicates a network-reachable, low-complexity attack requiring only low-privilege authentication with a confirmed public exploit. The moderate aggregate score of 5.3 reflects the PR:L authentication constraint, which limits opportunistic mass-scanning scenarios - unauthenticated remote exploitation is not confirmed. However, the E:P (exploit public) modifier combined with total vendor silence on disclosure substantially elevates real-world operational risk: there is no patch timeline, no workaround from the vendor, and a working exploit is freely accessible. The impact metrics (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) are consistent with embedded device compromise that can affect network traffic transiting through the device. No CISA KEV listing means active exploitation has not been confirmed at scale, and EPSS data is not provided; however, even a mid-sized municipal IT team in swidnica maintaining remote office connectivity through these Edimax devices should treat this as an elevated priority given the complete absence of a vendor remediation path. The combination of public PoC and unresponsive vendor is a high-risk posture regardless of raw score.

An attacker who has obtained low-privilege credentials to the Edimax EW-7478APC management interface - through default credentials, credential reuse, or prior phishing - submits a crafted WAN configuration request to /goform/setWAN with a pppUserName value containing shell metacharacters (e.g., '; id; #'). The firmware's setWAN function passes the unsanitized value directly to a shell command, executing the injected payload with device-level privileges. The published proof-of-concept exploit on Notion reduces the technical skill required to reproduce this attack chain.