EUVD-2026-31559
GHSA-w75f-j2p5-wgvr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain device credentials
-
DeliveryAccess web management interface
-
ExploitSend malicious POST to /goform/formWirelessTbl
-
ExecutionTrigger buffer overflow
-
PersistExecute arbitrary code
-
ImpactCompromise device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Successful exploitation requires valid authentication credentials to the Edimax EW-7438RPn web management interface. The device must be running firmware version 1.31 or earlier. Network access to the web interface is required, either from the local network or remotely if WAN-side management is enabled. The specific vulnerability is in the wireless table configuration functionality, which is typically accessible after authentication. |
| Impact | The CVSS 3.1 score of 8.8 (High) reflects significant risk with network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. The requirement for low privileges (PR:L) indicates authentication is needed, slightly reducing the attack surface compared to unauthenticated flaws. The E:P (Proof-of-Concept) metric confirms exploit code exists, as evidenced by the GitHub repository. However, this vulnerability is not currently listed in CISA KEV, suggesting targeted rather than widespread exploitation. The vendor's non-response to disclosure attempts increases risk as no official patch timeline exists. For home users and small businesses using these devices, the risk is moderate given the authentication requirement, but the availability of public exploit code elevates the threat. |
| Exploit ScenarioDerived | An attacker with valid administrative credentials (or compromised credentials) accesses the device's web interface and sends a specially crafted HTTP POST request to /goform/formWirelessTbl with an oversized submit-url parameter. This triggers a buffer overflow in the formWirelessTbl function, allowing the attacker to execute arbitrary code with the privileges of the web server process, potentially gaining full control of the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attackers to execute arbitrary code via crafted POST requests to the wireless table management interface. The vulnerability affects the formWirelessTbl function when processing the submit-url parameter, with publicly available exploit code on GitHub demonstrating the attack method.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond to the vulnerability disclosure. As immediate mitigation, restrict access to the device's web management interface by implementing strict firewall rules to allow only trusted IP addresses, disable remote management features if not required, and ensure strong administrative credentials are in use. Consider replacing the device with an alternative product if these mitigations are insufficient for your risk tolerance. Monitor the vendor's support page for any future firmware updates addressing this issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a WiFi range extender/repeater device. The vulnerability resides in the embedded web server component (webs) that handles device configuration through a web interface. The formWirelessTbl function at the /goform/formWirelessTbl endpoint processes wireless configuration table data without proper bounds checking on the submit-url parameter. This is a classic buffer overflow (CWE-120) where user-supplied data exceeds allocated memory boundaries, potentially overwriting adjacent memory regions including the execution stack.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn WiFi range extenders running firmware version 1.31 and earlier contain a critical remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands on affected devices. Organizations deploying these extenders in production networks face direct risk of device compromise and potential lateral movement into connected infrastructure if administrative credentials are compromised or weak.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable administrative web interface remote access; require local network access only for management. (2) Implement strict network segmentation isolating extender management traffic. (3) Enforce strong authentication (complex passwords, change defaults immediately). (4) Monitor device logs for suspicious POST requests to /formWirelessTbl endpoint. (5) Consider disabling wireless table management features if not operationally required. (6) Evaluate replacement with patched alternatives pending vendor security update availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Related Vulnerabilities in Edimax EW-7438RPn Multiple Buffer Overflow Vulnerabilities
View all 5More in Ew 7438Rpn
View allStack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB