Edimax EW-7438RPn CVE-2026-9482

Attacker must have network reachability to the EW-7438RPn HTTP administration interface (normally LAN-side only) and valid low-privilege web UI credentials, per CVSS PR:L - exploitation is not zero-touch unauthenticated. The vulnerable code path is the formSDHCP handler at /goform/formSDHCP, so the static-DHCP feature surface must be reachable (it is exposed by default in firmware 1.31). No user interaction is required (UI:N). Limiting factors: the device's management plane is not WAN-exposed in default deployments, the small installed base of a consumer range extender, the requirement for credentials, and the low EPSS (0.04%) reflecting that opportunistic attackers are not actively scanning for this; the most realistic exploitation context is a malicious insider on the local network or a chained attack after Wi-Fi/credential compromise.

CVSS 4.0 reports 7.4 (High) with network attack vector, low complexity, low privileges required (PR:L - an authenticated session to the web UI is needed), no user interaction, and high impact to confidentiality, integrity, and availability of the device itself (scope unchanged). EPSS is very low at 0.04% (13th percentile) and the vulnerability is NOT on CISA KEV, indicating no observed mass exploitation despite a public PoC. The authentication requirement and the fact that the management interface is normally LAN-only meaningfully reduce real-world risk - the realistic threat is a malicious LAN user, a CSRF-leveraged attack against a logged-in admin, or exposure where the admin interface has been imprudently published to the WAN. Mitigating factor: the vendor has gone silent, so no patch is forthcoming, making compensating controls the only defense.

An attacker on the same Wi-Fi network as the extender (for example a guest, a compromised IoT device, or someone who already cracked WPA2) authenticates to the web UI using default or guessed credentials, then issues a POST to /goform/formSDHCP with an oversized submit-url value crafted from the public PoC at github.com/wudipjq/my_vuln, overflowing the stack buffer. Depending on firmware mitigations the result is at minimum a denial of service (device reboot loop) and at worst arbitrary code execution as the web daemon, giving the attacker a persistent pivot into the trusted network. A CSRF variant against a logged-in administrator could also trigger the overflow without the attacker possessing credentials directly.