EUVD-2026-31575
GHSA-ffgh-x7gp-prmx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain device credentials
-
DeliverySend malicious POST to /goform/formwlencrypt24g
-
ExploitOverflow buffer via key1 parameter
-
ExecutionExecute arbitrary code
-
ImpactEstablish backdoor access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid low-privileged credentials to authenticate to the Edimax EW-7438RPn web management interface. The attacker must have network access to reach the device's web server, typically on the local network unless remote management is enabled. The vulnerable endpoint /goform/formwlencrypt24g must be accessible, which appears to be part of the standard wireless configuration functionality in firmware 1.28a. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects network-accessible exploitation with low complexity requiring only low-privileged authentication. The attack vector (AV:N) and lack of user interaction (UI:N) make this remotely exploitable, though authentication is required (PR:L). The CVSS temporal metrics indicate proof-of-concept code exists (E:P) but remediation level is unavailable (RL:X). While the vulnerability has high technical impact allowing code execution, the requirement for authentication and targeting of a specific device model limits the attack surface compared to unauthenticated vulnerabilities. The vendor's lack of response elevates risk as no patch timeline exists. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to the device's web interface sends a specially crafted POST request to /goform/formwlencrypt24g with an oversized 'key1' parameter. This triggers a buffer overflow allowing the attacker to overwrite memory and execute arbitrary code on the device, potentially establishing persistent access to the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Buffer overflow in Edimax EW-7438RPn Wi-Fi range extender firmware 1.28a enables authenticated remote attackers to execute arbitrary code via malformed POST requests to the wireless encryption configuration endpoint. The vulnerability requires low-privilege authentication and has publicly available exploit code. No vendor response or patch has been provided despite early disclosure attempts.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the vulnerability disclosure. As compensating controls, administrators should restrict network access to the device's web interface by implementing firewall rules to block external access to the management interface, allowing only trusted internal IP addresses. Consider disabling remote management features if available in the device settings. Monitor for suspicious POST requests to /goform/formwlencrypt24g in device logs. Given the lack of vendor support, consider replacing the device with an actively maintained alternative if the risk is unacceptable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a Wi-Fi range extender/repeater device. The vulnerability resides in the formwlencrypt24g function that handles POST requests to /goform/formwlencrypt24g, which appears to be related to 2.4GHz wireless encryption configuration. The flaw is a classic buffer overflow (CWE-120) where the 'key1' parameter is not properly validated for length before being copied to a fixed-size buffer, allowing memory corruption and potential code execution.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
CVE-2026-9360 is a high-severity buffer overflow in Edimax EW-7438RPn Wi-Fi extenders (firmware 1.28a) that allows authenticated users to execute arbitrary code on affected devices. Organizations deploying these extenders face risk of network compromise through insider threats or credential theft, with no vendor patch currently available to remediate the vulnerability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to affected devices-place on isolated VLAN with minimal trust paths; (2) disable remote management interfaces and require local-only administration; (3) implement strict firewall rules blocking POST requests to the wireless encryption configuration endpoint from untrusted sources; (4) monitor authentication logs and POST activity for anomalous patterns; (5) evaluate device replacement with vendors offering active patch support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Exploit-DB