Which versions of Edimax EW-7438RPn are affected by CVE-2026-9360?

CVE-2026-9360 is a high-severity buffer overflow in Edimax EW-7438RPn Wi-Fi extenders (firmware 1.28a) that allows authenticated users to execute arbitrary code on affected devices.

Is there a public PoC exploit available for CVE-2026-9360?

Yes, a public proof-of-concept exploit is available for CVE-2026-9360. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9360?

Within 24 hours: inventory all Edimax EW-7438RPn devices in your environment and identify firmware versions; document network placement and connected systems. Within 7 days: isolate affected extenders to segregated networks or disable them pending vendor guidance; restrict administrative access to these devices to trusted personnel only; monitor for suspicious POST requests to wireless configuration endpoints. Within 30 days: contact Edimax for patch status confirmation; evaluate replacement with alternative vendors offering active security support; implement network segmentation to limit lateral movement if compromise occurs.

Edimax EW-7438RPn CVE-2026-9360

Q: What is the CVSS score of CVE-2026-9360?

CVE-2026-9360 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31575 HIGH

Classic Buffer Overflow (CWE-120)

2026-05-24 VulDB

GHSA-ffgh-x7gp-prmx

Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 26, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

May 24, 2026 - 07:45 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Buffer overflow in Edimax EW-7438RPn Wi-Fi range extender firmware 1.28a enables authenticated remote attackers to execute arbitrary code via malformed POST requests to the wireless encryption configuration endpoint. The vulnerability requires low-privilege authentication and has publicly available exploit code. No vendor response or patch has been provided despite early disclosure attempts.

Technical ContextAI

The Edimax EW-7438RPn is a Wi-Fi range extender/repeater device. The vulnerability resides in the formwlencrypt24g function that handles POST requests to /goform/formwlencrypt24g, which appears to be related to 2.4GHz wireless encryption configuration. The flaw is a classic buffer overflow (CWE-120) where the 'key1' parameter is not properly validated for length before being copied to a fixed-size buffer, allowing memory corruption and potential code execution.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the vulnerability disclosure. As compensating controls, administrators should restrict network access to the device's web interface by implementing firewall rules to block external access to the management interface, allowing only trusted internal IP addresses. Consider disabling remote management features if available in the device settings. Monitor for suspicious POST requests to /goform/formwlencrypt24g in device logs. Given the lack of vendor support, consider replacing the device with an actively maintained alternative if the risk is unacceptable.