EUVD-2026-31555
GHSA-r23w-53vr-mr47
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for Edimax devices
-
DeliveryAttempt default/weak credentials
-
ExploitSend malicious POST to /goform/formWizSurvey
-
ExecutionTrigger buffer overflow
-
PersistExecute arbitrary code
-
ImpactMaintain persistence on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access to the Edimax EW-7438RPn web management interface - either through compromised credentials, default credentials, or insider access. The device must be running firmware version 1.31 or earlier. The web interface must be accessible to the attacker over the network. Many consumer deployments leave management interfaces accessible from the LAN with default or weak credentials, making exploitation feasible in home and small office environments. |
| Impact | The CVSS 3.1 score of 8.8 reflects high severity with network attack vector (AV:N), low complexity (AC:L), but requires low privileges (PR:L). The EPSS data is not provided, but the existence of public exploit code (E:P) significantly increases real-world risk. While not listed in CISA KEV, the combination of public POC availability, network accessibility, and the vendor's non-response to disclosure attempts makes this a priority for organizations using affected devices. The required authentication (PR:L) provides some mitigation against mass exploitation, limiting attacks to scenarios where credentials are compromised or default credentials are used. |
| Exploit ScenarioDerived | An attacker with valid credentials (or default credentials if unchanged) accesses the device's web interface and sends a specially crafted HTTP POST request to /goform/formWizSurvey with an oversized ssid or ip parameter. This triggers a buffer overflow in the webs process, allowing the attacker to execute arbitrary code on the device with elevated privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attackers to execute arbitrary code by sending malformed parameters to the device configuration interface. The vulnerability affects the formWizSurvey function in /goform/formWizSurvey when processing ssid, manualssid, ip, mask, or gateway parameters, with publicly available exploit code existing on GitHub.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the disclosure. As immediate compensating controls, restrict network access to the device's web interface to trusted IP addresses only, ensure strong non-default credentials are configured, and consider placing the device behind a firewall that blocks external access to the management interface. Monitor for suspicious POST requests to /goform/formWizSurvey containing oversized parameter values. Consider replacing the device with a supported alternative if the vendor continues to be unresponsive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a WiFi range extender/repeater device. The vulnerability is a classic buffer overflow (CWE-120) in the web server component (webs) that handles device configuration. When the formWizSurvey function processes network configuration parameters during the setup wizard, it fails to properly validate input length before copying data to fixed-size buffers. The affected CPE identifier cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:* indicates all versions are potentially affected, though the description specifically mentions versions up to 1.31.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the function formWizSurvey of the file /goform/formWizSurvey of the component webs. Performing a manipulation of the argument ssid/manualssid/ip/mask/gateway results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 contain a high-severity buffer overflow vulnerability that allows authenticated attackers to execute arbitrary code on affected devices. Organizations using these extenders for network infrastructure face potential compromise of wireless connectivity and lateral movement into corporate networks, particularly in distributed office or remote work environments where these devices are commonly deployed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict access to device configuration interface (/goform/formWizSurvey) via firewall rules and network segmentation, limiting to authorized administrator IPs only; (2) Disable remote management capabilities if not required for operations; (3) Change default administrative credentials and enforce strong passwords; (4) Monitor network traffic for suspicious connections to the extender; (5) Implement network-level monitoring to detect anomalous behavior from affected devices; (6) Prepare contingency network topology for rapid device replacement or deactivation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Edimax EW-7438RPn Multiple Buffer Overflow Vulnerabilities
View all 5More in Ew 7438Rpn
View allStack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB