Which versions of Edimax EW-7438RPn are affected by CVE-2026-9459?

Edimax EW-7438RPn wireless range extenders (firmware 1.31) are vulnerable to remote exploitation that could disrupt device operation, intercept network traffic, or enable attacker access to the…

Is there a public PoC exploit available for CVE-2026-9459?

Yes, a public proof-of-concept exploit is available for CVE-2026-9459. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9459?

Within 24 hours: inventory all Edimax EW-7438RPn devices on network and document those with internet accessibility. Within 7 days: implement network segmentation to isolate affected devices, block internet egress, or restrict access to the /goform/formConnectionSetting endpoint via firewall rules. Within 30 days: complete migration to patched wireless range extender models.

Edimax EW-7438RPn CVE-2026-9459

Q: What is the CVSS score of CVE-2026-9459?

CVE-2026-9459 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31675 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-hwrg-8cjq-3gj6

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:48 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privileges to corrupt memory by sending crafted max_Conn or timeOut parameters to /goform/formConnectionSetting. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices unpatched. EPSS probability is low (0.04%), but the combination of public POC, network reachability, and full CIA impact warrants prompt action on exposed devices.

Technical ContextAI

The Edimax EW-7438RPn is a consumer/SOHO Wi-Fi range extender whose web management interface exposes /goform/ endpoints implemented in native code. The vulnerable handler formConnectionSetting fails to bound-check the max_Conn and timeOut parameters before copying them into a fixed-size stack buffer, matching CWE-121 (Stack-based Buffer Overflow). On embedded MIPS/ARM router firmware, such overflows typically overwrite the saved return address and can lead to arbitrary code execution as the web server process, which generally runs with high privileges on the device.

RemediationAI

No vendor-released patch identified at time of analysis, as Edimax did not respond to the reporter. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or hosts and disable any WAN-side/remote administration option (trade-off: legitimate remote management becomes unavailable), enforce strong unique admin credentials since exploitation requires PR:L authentication, and place the extender behind a segmented SSID/VLAN to limit who can reach /goform/formConnectionSetting. Where feasible, replace the EW-7438RPn with a supported model, as continued use of an end-of-support device with public exploit code and no vendor response represents ongoing risk; monitor https://vuldb.com/vuln/365440 and https://nvd.nist.gov/vuln/detail/CVE-2026-9459 for any future firmware update.