Which versions of Edimax EW-7438RPn are affected by CVE-2026-9479?

The Edimax EW-7438RPn Wi-Fi range extender contains an unpatched vulnerability with publicly available exploit code exploitable by authenticated users, creating a botnet infection risk for…

Is there a public PoC exploit available for CVE-2026-9479?

Yes, a public proof-of-concept exploit is available for CVE-2026-9479. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9479?

Within 24 hours: inventory all Edimax EW-7438RPn devices across the organization and identify which networks they serve; restrict device internet access if operationally feasible. Within 7 days: develop device remediation plan including replacement product evaluation and cost analysis; assess network segmentation options if replacement is delayed. Within 30 days: replace vulnerable devices with alternative Wi-Fi range extender products from verified vendors, or implement permanent network isolation; establish ongoing monitoring for suspected device compromise.

Edimax EW-7438RPn CVE-2026-9479

Q: What is the CVSS score of CVE-2026-9479?

CVE-2026-9479 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31711 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-434w-2p2w-phjf

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:52 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manipulation of the argument submit-url leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote attackers to corrupt memory via the submit-url parameter of the formLogout handler at /goform/formLogout. Publicly available exploit code exists per VulDB disclosure, and the vendor failed to respond to coordinated disclosure, leaving the device unpatched. EPSS probability is currently very low (0.04%, 13th percentile), but the device class - consumer SOHO networking gear - is a recurring target for botnet recruitment.

Technical ContextAI

The EW-7438RPn is a consumer-grade 802.11n universal Wi-Fi extender that exposes a web-based administration interface implemented through a goform/* CGI-style binary common to embedded Realtek/Edimax-derived firmware. CWE-121 (stack-based buffer overflow) indicates that the formLogout function copies the user-supplied submit-url argument into a fixed-size stack buffer without adequate bounds checking, allowing the saved return address or adjacent stack frame data to be overwritten. Embedded MIPS/ARM Linux devices of this class typically lack modern memory protections such as full ASLR or stack canaries, making such overflows directly exploitable for control-flow hijack. CPE coverage is limited to cpe:2.3:a:edimax:ew-7438rpn:*, but the EUVD record specifically pins the affected firmware to version 1.31.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure per the VulDB report at https://vuldb.com/vuln/365460. As compensating controls, administrators should ensure the device's web management interface is never exposed to the WAN (disable any remote-management feature, which on this device class is typically off by default but should be verified), change default administrator credentials to a strong unique password to defeat the PR:L precondition, segment the extender onto an isolated VLAN/SSID so a compromise does not pivot into the trusted LAN, and consider replacing the device with a currently-supported model given Edimax's silence on a roughly decade-old product line. Monitoring DHCP/ARP for unexpected traffic from the extender's MAC is a low-cost detection layer; the trade-off of all of the above is operational overhead on what is normally an install-and-forget consumer device.