Edimax EW-7438RPn CVE-2026-9426

The attacker needs network reachability to the device's HTTP administration interface on /goform/formHwSet AND valid low-privilege web-UI credentials (CVSS PR:L) - exploitation is not anonymous despite the description's 'executed remotely' phrasing. Limiting factors: most EW-7438RPn units sit behind NAT on a residential or small-office LAN with no WAN-side admin exposure; the device must be running firmware 1.31 (other versions unverified); and the attacker must be able to send a crafted POST to the formHwSet handler containing an oversized value in one of the affected parameters (Anntena, Mcs, regDomain, nic0Addr, nic1Addr, wlanAddr, wanAddr, wlanSSID, wlanChan, initgain, txcck, txofdm, or submit-url). No user interaction is required (UI:N), and attack complexity is low (AC:L), so once credentials and reachability are obtained, exploitation is straightforward and a public PoC is available.

Signals are mixed and partially conflicting. CVSS 4.0 is 7.4 (High) with AV:N/AC:L/PR:L/UI:N and VC:H/VI:H/VA:H - a network-reachable, low-complexity bug with full CIA impact but requiring low-level authentication. SSVC corroborates this: Exploitation=poc, Automatable=no, Technical Impact=total. EPSS is very low at 0.04% (13th percentile) and the CVE is not on CISA KEV, indicating no observed mass exploitation. Publicly available exploit code exists on GitHub (wudipjq/my_vuln), so opportunistic exploitation is feasible, but the device is an end-of-interest consumer extender with a small attack surface on the public internet - most deployments sit behind NAT on a LAN, sharply limiting realistic exposure. Practically, the high score reflects worst-case impact on an exposed device, not population-wide risk. Note also that PR:L conflicts with a typical 'remote unauthenticated' framing for SOHO routers - the CVSS implies the attacker first needs valid admin (or default) web credentials, which is a meaningful gating factor not stated in the description.

An attacker on the same LAN segment as the extender (or reaching it from the WAN if admin is foolishly exposed) authenticates to the web UI with valid or default credentials, then sends a crafted POST request to /goform/formHwSet with an oversized value in one of the vulnerable parameters such as wlanSSID or nic0Addr, overflowing the stack buffer in formHwSet. A public PoC at github.com/wudipjq/my_vuln demonstrates the crash primitive, which on this class of MIPS/ARM SOHO firmware typically yields code execution as root, giving the attacker a persistent foothold for traffic interception, DNS hijacking, or pivoting into the internal network.