EUVD-2026-31675
GHSA-hwrg-8cjq-3gj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privileges to corrupt memory by sending crafted max_Conn or timeOut parameters to /goform/formConnectionSetting. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices unpatched. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must be able to reach the device's HTTP management interface on the network and possess low-level credentials (CVSS PR:L) sufficient to invoke /goform/formConnectionSetting; no user interaction is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 rates this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, indicating a network-reachable, low-complexity attack that requires some level of authentication and yields full confidentiality, integrity, and availability impact on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same LAN (or who has reached the management interface via a misconfigured remote-admin setting) authenticates with default or weak admin credentials and sends a crafted POST to /goform/formConnectionSetting with an oversized max_Conn or timeOut value, smashing the stack and hijacking control flow of the web server. Because a public POC at https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_12/12.md documents the trigger, weaponization for code execution on the embedded device is straightforward, enabling persistent foothold for traffic interception or pivot into the internal network. |
| Remediation | No vendor-released patch identified at time of analysis, as Edimax did not respond to the reporter. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Edimax EW-7438RPn devices on network and document those with internet accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today