Which versions of Edimax EW-7438RPn are affected by CVE-2026-9426?

The Edimax EW-7438RPn wireless range extender (version 1.31) contains a remote code execution vulnerability for which publicly available exploit code exists.

Is there a public PoC exploit available for CVE-2026-9426?

Yes, a public proof-of-concept exploit is available for CVE-2026-9426. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9426?

Within 24 hours: Audit network inventory to identify all Edimax EW-7438RPn v1.31 units and map their business criticality and network location. Within 7 days: Implement network segmentation (VLAN/firewall rules) to restrict device access to trusted sources only, and evaluate the feasibility of replacement with alternative equipment from vendors with active security support. Within 30 days: Complete either device replacement or finalize long-term mitigation controls; ensure all affected units are documented in a monitored inventory.

Edimax EW-7438RPn CVE-2026-9426

Q: What is the CVSS score of CVE-2026-9426?

CVE-2026-9426 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31632 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-gw85-4wrc-rp3f

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:50 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/initgain/txcck/txofdm/submit-url results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privileges to corrupt memory and likely achieve code execution by manipulating multiple parameters (Anntena, Mcs, regDomain, nic0Addr/nic1Addr/wlanAddr/wanAddr, wlanSSID, wlanChan, initgain, txcck, txofdm, submit-url) sent to the formHwSet handler at /goform/formHwSet. Publicly available exploit code exists on GitHub, but EPSS rates real-world exploitation probability at only 0.04% (13th percentile) and the issue is not in CISA KEV. The vendor was contacted by the researcher but never responded, leaving the device unpatched.

Technical ContextAI

The Edimax EW-7438RPn is a consumer/SOHO Wi-Fi range extender whose web administration interface is served by an embedded HTTP daemon exposing /goform/* handlers - a common pattern in Realtek/Broadcom-based SOHO firmware. CWE-121 (stack-based buffer overflow) indicates the formHwSet function copies one or more of the listed POST parameters into a fixed-size stack buffer (likely via strcpy/sprintf/memcpy without bounds checking), corrupting the saved return address or adjacent stack frames. On these MIPS/ARM-based embedded devices, lack of stack canaries, ASLR, and NX in the firmware toolchain typically makes such overflows directly exploitable for arbitrary code execution as the web server process, which on this class of device usually runs as root. The single affected CPE confirmed is cpe:2.3:a:edimax:ew-7438rpn covering version 1.31.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to the researcher's coordinated disclosure attempt. Until/unless a firmware update is published on the Edimax support site, owners should isolate the device by ensuring its web administration interface is never exposed to the WAN (verify remote management is disabled), placing the extender on a management VLAN or guest network segment so only trusted hosts can reach /goform/formHwSet, and changing the default administrative password to raise the bar for the PR:L precondition. Where the device is operationally non-essential, replacement with a vendor-supported model is the most durable mitigation given the unresponsive vendor; trade-off of the network-segmentation approach is loss of convenient LAN-wide admin access, and password hardening alone does not stop an attacker who already has admin credentials. Track https://nvd.nist.gov/vuln/detail/CVE-2026-9426 and https://vuldb.com/vuln/365407 for any future vendor response.