EUVD-2026-31557
GHSA-q3f6-qj3x-v67j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain device credentials
-
DeliveryAuthenticate to web interface
-
ExploitSend malicious request to /goform/mp
-
ExecutionTrigger stack overflow
-
PersistExecute arbitrary code
-
ImpactEstablish persistence
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Successful exploitation requires valid authentication credentials to the device's web management interface and network access to the HTTP/HTTPS management port (typically 80/443). The device must be running firmware version 1.31 or earlier. No special configuration or non-default settings are required beyond having the web interface enabled, which is the default state for device management. |
| Impact | The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability. The attack vector is network-based with low complexity and no user interaction required, though authentication is needed (PR:L). The CVSS temporal metrics indicate a proof-of-concept exploit exists (E:P) with reasonable confidence (RC:R), but remediation level is unavailable (RL:X). While no EPSS score or CISA KEV listing is provided, the public exploit availability significantly increases real-world risk. The vendor's non-response to disclosure attempts means affected devices remain vulnerable indefinitely. This represents a serious risk for organizations using these devices, particularly given the authentication requirement provides only minimal protection against insider threats or compromised credentials. |
| Exploit ScenarioDerived | An attacker with valid credentials (or who has obtained them through phishing or credential stuffing) logs into the device's web interface and sends a specially crafted HTTP request to /goform/mp containing an oversized 'webs' parameter. This overwrites stack memory and allows execution of attacker-controlled code, potentially installing persistent backdoors or pivoting to internal networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Stack-based buffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attackers to execute arbitrary code by sending malicious input to the /goform/mp endpoint in the web server component. Public exploit code exists on GitHub, though the vulnerability is not listed in CISA KEV. The vendor failed to respond to responsible disclosure attempts, leaving devices unpatched.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor failed to respond to responsible disclosure attempts according to the CVE description. As immediate mitigation, restrict network access to the device's web management interface to trusted IP addresses only via firewall rules or access control lists. Consider disabling the web interface entirely if remote management is not required, though this limits device manageability. For critical deployments, consider replacing affected devices with alternative products from responsive vendors. Monitor vendor channels for potential future patches, though none appear forthcoming based on their non-response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a WiFi range extender/repeater device. The vulnerability resides in the 'webs' web server component that handles the device's management interface. When processing requests to the /goform/mp endpoint, improper bounds checking on the 'webs' parameter leads to a classic stack-based buffer overflow (CWE-121). This allows attackers to overwrite the return address and hijack control flow, potentially executing arbitrary code with the privileges of the web server process.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn WiFi range extenders running firmware version 1.31 and earlier contain a stack-based buffer overflow vulnerability that allows authenticated attackers to execute arbitrary code on affected devices. With public exploit code available and no vendor patch released, organizations using these devices for network extension face risk of unauthorized command execution and potential lateral movement into internal networks. This is particularly critical for businesses relying on these extenders in distributed office or retail environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict web management interface access via firewall ACLs to authorized administrators only; (2) Disable remote management features if not required; (3) Implement network segmentation to isolate WiFi extenders from critical assets; (4) Monitor device logs for suspicious authentication attempts and HTTP requests to /goform/mp endpoint; (5) Consider device replacement with actively maintained alternative WiFi extenders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in Edimax EW-7438RPn Multiple Buffer Overflow Vulnerabilities
View all 5More in Ew 7438Rpn
View allStack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Exploit-DB