Edimax EW-7438RPn CVE-2026-9427

Attacker must be able to reach the device's HTTP management interface (TCP 80/443) and must possess valid low-privilege web UI credentials (PR:L in the CVSS vector - typically the admin or guest account on the range extender). The vulnerable endpoint /goform/formWlSiteSurvey in the 'webs' component must be reachable, which is the case in default configurations on the LAN side; exploitation requires firmware version 1.31 specifically. Limiting factors: the management interface is not exposed to the WAN by default on most deployments, no user interaction is required (UI:N), and the attack does not chain to other components (Scope: unchanged, SC:N/SI:N/SA:N), so impact is confined to the device itself unless used as a LAN pivot.

Signals are mixed but lean toward meaningful risk for exposed devices. CVSS 4.0 scores 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H - network-reachable, low complexity, but requiring low privileges (an authenticated session on the web UI), with high impact to confidentiality, integrity, and availability of the device itself (Scope: unchanged). EPSS is very low at 0.04% (13th percentile), which conflicts somewhat with the existence of a published PoC; this likely reflects that the device is niche consumer hardware not widely scanned for. The CVE is NOT in CISA KEV, so no confirmed active exploitation. SSVC marks Exploitation as 'poc', Automatable 'no' (each device must be individually targeted, often behind NAT), and Technical Impact 'total'. The PR:L requirement is a meaningful limiter - most home/SMB deployments do not expose the admin UI to the internet, and default credentials would need to be known or guessed. Net assessment: high impact per successful exploit, but realistic exposure is limited to devices with internet-facing management or compromised LAN access.

An attacker who has obtained low-privilege credentials to the EW-7438RPn web UI (default credentials, phishing, or LAN-side access) sends a crafted POST to /goform/formWlSiteSurvey with an oversized selSSID or submit-url parameter, overflowing the stack buffer in formWlSiteSurvey and overwriting the saved return address to redirect execution to shellcode in the request body. Publicly available exploit code exists at github.com/wudipjq/my_vuln, lowering the skill barrier substantially. A successful exploit yields code execution in the context of the webs process, typically root on embedded Linux, enabling persistent backdoor installation, traffic interception, or use of the device as a pivot into the LAN.