EUVD-2026-31628
GHSA-5rm7-2pfg-jpcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Edimax EW-7438RPn 1.31. The affected element is the function formWlanMP of the file /goform/formWlanMP of the component Content-Type Handler. Executing a manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in Edimax EW-7438RPn 1.31 allows a low-privileged, remote attacker to execute arbitrary commands on the device by manipulating any of approximately 29 parameters passed to the formWlanMP function via the /goform/formWlanMP endpoint. The vulnerable parameters - including ateFunc, ateGain, ateTxCount, and e2pTxPower series - are characteristic of ATE (Automatic Test Equipment) manufacturing-mode calibration parameters left accessible in the production firmware. A public proof-of-concept exploit has been published on GitHub, and the vendor did not respond to the disclosure; no patch is available. No public exploit identified as confirmed actively exploited (CISA KEV), though the public PoC elevates real-world risk.
Technical ContextAI
The Edimax EW-7438RPn is a consumer 802.11n WiFi range extender running embedded Linux with a GoForm-based CGI web management interface. The affected function, formWlanMP, handles Content-Type form submissions at /goform/formWlanMP and passes user-supplied parameter values - including ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, e2pTxPower1 through e2pTxPower7, e2pTx2Power1 through e2pTx2Power7, ateTxFreqOffset, ateMode, ateBW, ateAntenna, e2pTxFreqOffset, e2pTxPwDeltaB/G/Mix/N, and readE2P - directly or insufficiently sanitized into OS-level command invocations. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw. The 'ate' prefix and 'e2p' (EEPROM) prefix parameter names indicate this endpoint was designed for chipset-level factory testing and calibration and was not stripped from the production firmware. The affected CPE is cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:*, with confirmed affected version 1.31 per EUVD-2026-31628.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor was contacted prior to disclosure and did not respond, and no security advisory has been published. As the primary mitigation, restrict management interface access by placing the device behind a firewall and blocking all inbound access to the HTTP/HTTPS management port (typically TCP 80/443) from untrusted network segments - this eliminates the network attack surface entirely, though it does not address LAN-side attackers. Disable remote management features if the firmware supports that option. Consider replacing the device with a supported model from an actively maintained product line, as the vendor's non-response suggests no patch is forthcoming. If replacement is not immediate, isolate the device on a dedicated IoT VLAN with strict egress filtering to limit the blast radius of exploitation. Network-based intrusion detection rules monitoring for anomalous POST requests to /goform/formWlanMP may assist in detecting exploitation attempts. The public PoC at https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_7/7.md should be reviewed by defenders to understand the exact payload shape for detection rule development.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today