Edimax EW-7438RPn CVE-2026-9460

Exploitation requires (1) network-layer reachability to the EW-7438RPn web administration interface on the LAN or, if remote management is enabled, over the WAN; (2) valid low-privilege web UI credentials per CVSS PR:L - default credentials qualify and are commonly unchanged on consumer extenders; (3) the device running firmware version 1.31 as identified in EUVD-2026-31676; and (4) the ability to send a crafted HTTP request to the /goform/formAccept endpoint with an oversized submit-url argument. No user interaction is required (UI:N). Exploitation is limited by the fact that most EW-7438RPn units are deployed behind NAT on residential networks without exposed management interfaces, and by the PR:L authentication barrier - although weak default credentials substantially erode that limit.

The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact over an adjacent web management interface that requires low privileges (PR:L) but no user interaction, with proof-of-concept exploit maturity (E:P). However, the EPSS score of 0.04% (13th percentile) is extremely low and the vulnerability is not on the CISA KEV list, indicating no observed mass exploitation despite a public PoC - consistent with the limited internet exposure of a niche consumer range extender. The conflicting signals (public exploit + unresponsive vendor versus low EPSS and no KEV) suggest this is a real but narrow-targeting risk: opportunistic botnet operators could weaponize the PoC against exposed devices, but most EW-7438RPn units sit behind NAT on residential LANs, limiting realistic attack surface. The PR:L authentication requirement materially limits exploitation to attackers who already have valid (or default) management credentials.

An attacker who has obtained low-privileged web UI credentials (default, weak, or phished) on a reachable EW-7438RPn issues an HTTP POST to /goform/formAccept with an oversized submit-url parameter crafted to overwrite the saved return address on the stack. Using the published PoC at github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_13/13.md as a template, the attacker pivots execution to shellcode placed in the request body, gaining a root shell on the extender and using it as a foothold to pivot into the LAN, sniff Wi-Fi traffic, or enroll the device into a botnet.