Edimax EW-7438RPn CVE-2026-9463

Exploitation requires (1) network reachability to the device's HTTP management interface on the LAN or WAN, and (2) authenticated access at low privilege (CVSS PR:L) sufficient to reach the /goform/formLicence endpoint via the submit-url parameter handled by the formLicence function. No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the management UI is typically not exposed to the internet by default, and an attacker must possess valid (or default/weak) credentials for the device - a meaningful barrier on hardened deployments but trivially bypassed on devices left at factory defaults. Only firmware version 1.31 of the EW-7438RPn is confirmed affected.

CVSS 4.0 scores this 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N and high impact across confidentiality, integrity, and availability, meaning a low-privileged authenticated attacker on the network can trigger the flaw with no user interaction. EPSS is very low at 0.04% (13th percentile) and CISA SSVC marks Exploitation as 'poc' with Automatable:no and Technical Impact:total - consistent with a working but manual exploit rather than worm-grade automation. The device is not on CISA KEV, so this should be treated as publicly available exploit code exists rather than confirmed active exploitation. Real-world priority is moderate: the population of internet-exposed range extenders is small, but the combination of PR:L (a guessable/default admin login often suffices), a published POC, total technical impact, and an unresponsive vendor with no patch elevates risk for any device whose management UI is reachable beyond the trusted LAN.

An attacker who has obtained low-privileged web UI credentials (default creds, a phished/reused password, or a separately exploited auth bypass) sends a single crafted HTTP POST to /goform/formLicence with an oversized submit-url parameter, smashing the stack of the embedded httpd. Using the publicly available POC at github.com/wudipjq/my_vuln, this can be turned into a reliable crash for denial of service or, on firmware lacking stack canaries and NX, control-flow hijack to execute attacker-supplied shellcode as the web server process - typically root on these embedded devices.