Which versions of Edimax EW-7438RPn are affected by CVE-2026-9427?

Edimax EW-7438RPn 1.31 wireless range extenders contain a stack-based buffer overflow vulnerability (CVE-2026-9427, CVSS 7.4) exploitable by authenticated attackers through the device web interface,…

Is there a public PoC exploit available for CVE-2026-9427?

Yes, a public proof-of-concept exploit is available for CVE-2026-9427. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9427?

Within 24 hours: Conduct inventory of all Edimax EW-7438RPn 1.31 devices and audit which network segments or users have administrative access to their web interface. Within 7 days: Restrict administrative access to affected devices to trusted IP ranges and staff roles only; begin vendor evaluation for replacement models; submit formal support request to Edimax for patch status. Within 30 days: Replace all Edimax EW-7438RPn 1.31 units with alternative wireless range extender solutions from actively supported vendors, or if retention is operationally mandated, migrate affected devices to an isolated management network with strict firewall rules limiting inbound access to authorized administrators only.

Edimax EW-7438RPn CVE-2026-9427

Q: What is the CVSS score of CVE-2026-9427?

CVE-2026-9427 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31631 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-wv7w-gprg-vf9f

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:28 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A flaw has been found in Edimax EW-7438RPn 1.31. This impacts the function formWlSiteSurvey of the file /goform/formWlSiteSurvey of the component webs. This manipulation of the argument selSSID/submit-url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to corrupt memory by manipulating the selSSID or submit-url parameters in the formWlSiteSurvey handler (/goform/formWlSiteSurvey) of the embedded web server. Publicly available exploit code exists and the vendor did not respond to disclosure attempts, leaving the device without a confirmed patch. EPSS rates exploitation probability low at 0.04%, but the combination of public PoC and unresponsive vendor makes exposed devices a concrete risk.

Technical ContextAI

The Edimax EW-7438RPn is a consumer/SMB Wi-Fi range extender whose web management interface (the 'webs' component) handles wireless site survey actions through CGI-style endpoints under /goform/. The vulnerability is a classic CWE-121 (Stack-based Buffer Overflow): user-controlled input from the selSSID and submit-url HTTP parameters is copied into fixed-size stack buffers in the formWlSiteSurvey function without proper length validation. On typical MIPS/ARM embedded Linux firmware like Edimax's, such overflows overwrite the saved return address on the stack and can pivot execution to attacker-controlled data, especially since these devices rarely enable modern mitigations like stack canaries, ASLR, or non-executable stacks consistently. The affected CPE is cpe:2.3:a:edimax:ew-7438rpn confirmed for firmware 1.31.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to the researcher's disclosure attempts, so administrators cannot rely on a forthcoming firmware update. As compensating controls, restrict access to the device's web management interface to a trusted management VLAN or single admin host using ACLs on the upstream router, ensuring it is never reachable from the WAN side (verify by external scanning of the WAN IP for port 80/443). Change the default administrator credentials to a strong unique password to make exploitation of the PR:L requirement harder, and disable remote management features if present. For high-assurance environments, consider replacing the EW-7438RPn with a supported device given the vendor's unresponsiveness; the trade-off of LAN-only ACLs is loss of remote administration convenience, which is acceptable for most home/SMB deployments. Monitor the VulDB record at https://vuldb.com/vuln/365408 and the NVD entry for any future vendor advisory.