Edimax EW-7438RPn CVE-2026-9481

Attacker requires network reachability to the device's web administration interface (typically TCP/80 on the LAN side) AND valid low-privileged web UI credentials per CVSS PR:L - exploitation is not achievable fully unauthenticated. The vulnerable code path is the formStats handler at /goform/formStats reached via the 'submit-url' POST parameter, present in firmware 1.31 of the EW-7438RPn specifically. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once authenticated network access exists, the published PoC can be run directly. Practical limiters: the admin interface is normally LAN-only, so external exploitation requires either WAN-side management being enabled or pivoting from a compromised internal host; widespread use of default credentials on consumer extenders meaningfully weakens the PR:L barrier.

Signals are mixed and require careful weighting. CVSS 4.0 scores this 7.4 (High) with AV:N/AC:L/PR:L/UI:N and High impact on confidentiality, integrity, and availability - meaning network-reachable, low-complexity, but requiring some level of authentication. SSVC reports Exploitation=PoC, Automatable=no, Technical Impact=total, which aligns with a publicly published PoC that still requires manual targeting. EPSS is very low at 0.04% (13th percentile), and the CVE is NOT on CISA KEV - no confirmed active exploitation. The PR:L requirement is the key limiter: an attacker needs valid credentials (often default admin/admin on consumer extenders) or LAN access to a web UI that should not be Internet-exposed. Real-world risk is moderate for devices with default credentials or exposed admin interfaces, low for properly configured deployments, but elevated by the absence of any vendor patch.

An attacker who has obtained valid web-admin credentials (commonly default 'admin' on consumer extenders) sends a crafted HTTP POST to /goform/formStats with an overlong 'submit-url' parameter. The oversized value overflows a stack buffer in the formStats handler, overwriting the saved return address and redirecting execution to attacker-controlled shellcode or a ROP chain, yielding code execution as the web server process (typically root on embedded firmware). The published PoC at github.com/wudipjq/my_vuln lowers the skill barrier substantially.