Which versions of Edimax EW-7438RPn are affected by EUVD-2026-31629?

Edimax EW-7438RPn 1.31 range extenders contain an unpatched remote code execution vulnerability accessible to authenticated users, with working exploit code publicly available.

Is there a public PoC exploit available for EUVD-2026-31629?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31629. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31629?

Within 24 hours: Conduct complete inventory of Edimax EW-7438RPn 1.31 devices across all locations; restrict administrative access via firewall rules. Within 7 days: Enable all available logging on affected devices; establish monitoring for Edimax firmware advisories; restrict device access to specific trusted administrator accounts only. Within 30 days: Evaluate replacement with alternative range extender models from vendors providing active security support, or isolate affected devices on segregated networks if replacement not feasible.

Edimax EW-7438RPn EUVD-2026-31629

Q: What is the CVSS score of EUVD-2026-31629?

EUVD-2026-31629 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9425 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-597q-8598-j8gq

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:29 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The impacted element is the function formWlanMP of the file /goform/formWlanMP. The manipulation of the argument ateFunc/ateGain/ateTxCount/ateChan/ateRate/ateMacID/e2pTxPower1/e2pTxPower2/e2pTxPower3/e2pTxPower4/e2pTxPower5/e2pTxPower6/e2pTxPower7/e2pTx2Power1/e2pTx2Power2/e2pTx2Power3/e2pTx2Power4/e2pTx2Power5/e2pTx2Power6/e2pTx2Power7/ateTxFreqOffset/ateMode/ateBW/ateAntenna/e2pTxFreqOffset/e2pTxPwDeltaB/e2pTxPwDeltaG/e2pTxPwDeltaMix/e2pTxPwDeltaN/readE2P leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender's formWlanMP handler (/goform/formWlanMP) allows remote authenticated attackers to corrupt memory and potentially achieve arbitrary code execution on the device. Publicly available exploit code exists, but EPSS remains low at 0.04% and there is no CISA KEV listing, indicating no confirmed widespread active exploitation. The vendor was contacted but did not respond, leaving the issue unpatched.

Technical ContextAI

The EW-7438RPn is a consumer-grade Wi-Fi range extender whose web administration interface includes a manufacturing/ATE (Automated Test Equipment) test endpoint at /goform/formWlanMP. This handler accepts a large set of test-mode parameters (ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, e2pTxPower1-7, e2pTx2Power1-7, ateTxFreqOffset, ateMode, ateBW, ateAntenna, e2pTxFreqOffset, e2pTxPwDeltaB/G/Mix/N, readE2P) and copies them into fixed-size stack buffers without proper bounds checking, mapping directly to CWE-121 (Stack-based Buffer Overflow). Such embedded HTTP daemons are typically compiled as MIPS or ARM C binaries with limited exploit mitigations (often no stack canaries, no ASLR, RWX memory regions), which makes stack overflows in /goform/* handlers a well-known and frequently weaponizable bug class on SOHO networking gear.

RemediationAI

No vendor-released patch identified at time of analysis - the researcher reports that Edimax did not respond to coordinated disclosure, so administrators cannot rely on a fixed firmware version. As compensating controls, restrict administrative access to the device's web interface to a trusted management VLAN or single jump host via ACLs (trade-off: legitimate admins must connect from that segment), explicitly block external/WAN access to the management UI and to the /goform/formWlanMP path at any upstream firewall or reverse proxy (trade-off: none for normal users, since this is an ATE/test endpoint not intended for production use), enforce strong non-default administrator credentials since exploitation requires PR:L (trade-off: minimal), and consider replacing the device with a currently-supported range extender if business-critical, since the vendor's non-response suggests the product may be end-of-life. Monitor https://nvd.nist.gov/vuln/detail/CVE-2026-9425 and https://vuldb.com/vuln/365406 for any future vendor advisory or third-party firmware fix.