Which versions of Edimax EW-7438RPn are affected by CVE-2026-9348?

Edimax EW-7438RPn WiFi range extenders running firmware version 1.31 and earlier contain a stack-based buffer overflow vulnerability that allows authenticated attackers to execute arbitrary code on…

Is there a public PoC exploit available for CVE-2026-9348?

Yes, a public proof-of-concept exploit is available for CVE-2026-9348. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9348?

Within 24 hours: Inventory all Edimax EW-7438RPn devices in production and document current firmware versions. Within 7 days: Restrict network access to affected devices by implementing access control lists (ACLs) to limit management traffic to trusted IP ranges only, and change all default credentials. Within 30 days: Contact Edimax support to determine if a firmware update exists beyond version 1.31, or evaluate replacement with alternative WiFi extenders from vendors with active security support.

Edimax EW-7438RPn CVE-2026-9348

Q: What is the CVSS score of CVE-2026-9348?

CVE-2026-9348 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31557 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-24 VulDB

GHSA-q3f6-qj3x-v67j

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 24, 2026 - 03:45 vuln.today

DescriptionCVE.org

A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attackers to execute arbitrary code by sending malicious input to the /goform/mp endpoint in the web server component. Public exploit code exists on GitHub, though the vulnerability is not listed in CISA KEV. The vendor failed to respond to responsible disclosure attempts, leaving devices unpatched.

Technical ContextAI

The Edimax EW-7438RPn is a WiFi range extender/repeater device. The vulnerability resides in the 'webs' web server component that handles the device's management interface. When processing requests to the /goform/mp endpoint, improper bounds checking on the 'webs' parameter leads to a classic stack-based buffer overflow (CWE-121). This allows attackers to overwrite the return address and hijack control flow, potentially executing arbitrary code with the privileges of the web server process.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor failed to respond to responsible disclosure attempts according to the CVE description. As immediate mitigation, restrict network access to the device's web management interface to trusted IP addresses only via firewall rules or access control lists. Consider disabling the web interface entirely if remote management is not required, though this limits device manageability. For critical deployments, consider replacing affected devices with alternative products from responsive vendors. Monitor vendor channels for potential future patches, though none appear forthcoming based on their non-response.