EUVD-2026-31573
GHSA-fcv6-974v-wfp4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formConnectionSetting of the component Setting Handler. Such manipulation of the argument max_Conn/timeOut leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax EW-7438RPn 1.12 allows authenticated remote attackers to execute arbitrary operating system commands via the max_Conn and timeOut parameters in the formConnectionSetting endpoint. The vulnerability requires low-privilege authentication but no user interaction, with public exploit code available. EPSS data not available; vendor unresponsive to disclosure.
Technical ContextAI
The vulnerability resides in the Setting Handler component's formConnectionSetting function at /goform/formConnectionSetting. This is a classic command injection flaw (CWE-77) where user-supplied input from the max_Conn and timeOut parameters is passed unsanitized to a system shell command interpreter. The affected product is the Edimax EW-7438RPn wireless range extender running firmware version 1.12 (cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:*). Command injection vulnerabilities in embedded networking devices are particularly severe because they typically run with root privileges and offer direct access to the underlying Linux operating system, enabling full device compromise.
RemediationAI
No vendor-released patch is available for this vulnerability. The vendor (Edimax) did not respond to early disclosure attempts, indicating no official fix is forthcoming. Organizations must implement compensating controls: (1) Disable remote management access to the device's web interface entirely and restrict access to trusted local network segments only - side effect: eliminates remote administration capability; (2) Place devices behind network access controls (firewall rules, VLANs) limiting access to authorized administrator IP addresses only - requires infrastructure changes and may complicate legitimate remote management; (3) Change default administrative credentials to strong unique passwords to mitigate credential-based attacks that provide the required PR:L access - attackers with existing access can still exploit; (4) Monitor device logs for suspicious formConnectionSetting POST requests with unusual max_Conn or timeOut parameter values - requires log aggregation infrastructure; (5) Consider replacing affected devices with actively supported models from vendors with established security response programs. See VulDB entry https://vuldb.com/vuln/365325 for ongoing updates.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today