Edimax EW-7438RPn CVE-2026-9425

Exploitation requires network reachability to the device's HTTP management interface on the LAN-side (or WAN-side if remote administration is enabled), valid authenticated access to the web UI at the privilege level needed to reach /goform/formWlanMP (CVSS PR:L), and the ability to send a crafted POST containing an oversized value in one of the ATE/e2p test-mode parameters (ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, e2pTxPower1-7, e2pTx2Power1-7, ateTxFreqOffset, ateMode, ateBW, ateAntenna, e2pTxFreqOffset, e2pTxPwDeltaB/G/Mix/N, or readE2P) on an EW-7438RPn running firmware 1.31. Limiting factors are the authentication requirement, the typical LAN-only exposure of the management interface on consumer extenders, and the fact that achieving reliable code execution (versus a crash) on an embedded MIPS/ARM target generally requires per-firmware ROP work - reflected in SSVC Automatable: no. No user interaction is required (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 and reflects network-reachable, low-complexity exploitation requiring low-level authentication, with high impact on confidentiality, integrity, and availability of the device itself (no scope change). SSVC corroborates this: exploitation status is 'poc' (publicly disclosed PoC on GitHub via wudipjq/my_vuln), automatable is 'no' (likely because reliable RCE on embedded MIPS/ARM stacks usually requires per-target ROP tuning), and technical impact is 'total' (full device compromise once exploitation succeeds). EPSS is very low at 0.04% (13th percentile) and the CVE is not in CISA KEV, suggesting no current evidence of in-the-wild mass exploitation. The realistic priority is moderate: a determined attacker on a reachable management interface can likely achieve code execution, but the PR:L requirement and lack of automatable exploitation reduce the chance of opportunistic worming. A key caveat is that PR:L assumes the /goform/formWlanMP endpoint enforces authentication - many ATE/manufacturing endpoints on consumer routers historically do not, so defenders should verify whether the handler is actually gated rather than relying on the CVSS assumption.

An attacker who has obtained valid low-privilege credentials to the EW-7438RPn web UI - for example a default or weak admin password, or credentials harvested from a phishing or LAN-resident foothold - sends a crafted HTTP POST to /goform/formWlanMP with an oversized value in one of the ATE/e2p parameters such as ateMacID or e2pTxPower1, overflowing a stack buffer in the formWlanMP handler. With the publicly available PoC on GitHub (wudipjq/my_vuln) as a starting point and per-target ROP gadgetry, the attacker corrupts the saved return address to execute arbitrary code as the web daemon (typically root on these devices), gaining persistent control of the extender for traffic interception, DNS hijacking, or pivoting into the local network.