Which versions of Edimax EW-7438RPn are affected by CVE-2026-9461?

The Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) contains a remotely exploitable stack buffer overflow that can corrupt device memory, with publicly available exploit code circulating and…

Is there a public PoC exploit available for CVE-2026-9461?

Yes, a public proof-of-concept exploit is available for CVE-2026-9461. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9461?

Within 24 hours: Inventory all deployed Edimax EW-7438RPn units running firmware 1.31; document network role and dependent client count for each. Within 7 days: Isolate affected devices to restricted network segments; restrict administrative access to trusted management VLANs only; document interim controls. Within 30 days: Execute hardware replacement with patched Wi-Fi extender alternatives or establish permanent network-level containment with access control lists and monitoring.

Edimax EW-7438RPn CVE-2026-9461

Q: What is the CVSS score of CVE-2026-9461?

CVE-2026-9461 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31680 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-68hc-jq62-w8v4

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:36 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated attackers to corrupt memory by sending an oversized submit-url parameter to the formRadius handler at /goform/formRadius. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure attempts, leaving the device without a confirmed fix. EPSS probability is currently low (0.04%), but the combination of a public PoC, total technical impact, and unpatched status warrants urgent attention for any deployed units.

Technical ContextAI

The Edimax EW-7438RPn is a SOHO Wi-Fi range extender whose embedded web management interface exposes CGI-style endpoints under /goform/. The vulnerable formRadius handler parses the submit-url HTTP parameter into a fixed-size stack buffer without adequate bounds checking, the classic CWE-121 (Stack-based Buffer Overflow) pattern common in MIPS/ARM embedded BusyBox-style web daemons. On such devices the web server typically runs as root with no ASLR or stack canaries, so corruption of the saved return address can be steered toward arbitrary code execution or, at minimum, a reliable crash of the management plane.

RemediationAI

No vendor-released patch identified at time of analysis, as Edimax did not respond to the coordinated disclosure. In the absence of a firmware update, restrict access to the device's web management interface to a trusted management VLAN or host, disable remote/WAN administration if enabled (trade-off: loss of off-LAN management), and change default and weak admin credentials since exploitation requires PR:L. Where feasible, segment the extender onto an isolated SSID/VLAN and monitor for unexpected reboots or configuration changes; for end-of-support deployments, plan replacement with a currently supported device. Track the VulDB advisory at https://vuldb.com/vuln/365442 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9461 for any future vendor response.