EUVD-2026-31675
GHSA-hwrg-8cjq-3gj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach device web UI on LAN
-
DeliveryAuthenticate with low-privilege admin credentials
-
ExploitPOST oversized max_Conn/timeOut to /goform/formConnectionSetting
-
InstallOverflow stack buffer in formConnectionSetting
-
C2Hijack saved return address
-
ExecuteExecute code as web server on device
-
ImpactPivot or intercept LAN traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must be able to reach the device's HTTP management interface on the network and possess low-level credentials (CVSS PR:L) sufficient to invoke /goform/formConnectionSetting; no user interaction is required. Exploitation is specifically limited to Edimax EW-7438RPn firmware 1.31 and requires sending crafted max_Conn or timeOut parameters to the formConnectionSetting handler. Practical limits include the device's typical LAN-only management exposure and the need for valid admin authentication, which together constrain mass exploitation but do not protect against insiders, default-credential deployments, or attackers who have already reached the LAN. |
| Impact | CVSS 4.0 rates this 7.4 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and VC:H/VI:H/VA:H, indicating a network-reachable, low-complexity attack that requires some level of authentication and yields full confidentiality, integrity, and availability impact on the device. EPSS is very low at 0.04% (13th percentile), and the CVE is not on CISA KEV, but a public POC exists on GitHub and SSVC classifies the technical impact as 'total' with exploitation status 'poc' and automatable 'no'. The PR:L requirement (likely a web admin credential) and the niche consumer-extender footprint plausibly explain the low EPSS despite total technical impact - meaningful risk concentrates on devices with default/weak credentials or exposed management interfaces, rather than mass exploitation. |
| Exploit ScenarioDerived | An attacker on the same LAN (or who has reached the management interface via a misconfigured remote-admin setting) authenticates with default or weak admin credentials and sends a crafted POST to /goform/formConnectionSetting with an oversized max_Conn or timeOut value, smashing the stack and hijacking control flow of the web server. Because a public POC at https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_12/12.md documents the trigger, weaponization for code execution on the embedded device is straightforward, enabling persistent foothold for traffic interception or pivot into the internal network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privileges to corrupt memory by sending crafted max_Conn or timeOut parameters to /goform/formConnectionSetting. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure, leaving deployed devices unpatched. EPSS probability is low (0.04%), but the combination of public POC, network reachability, and full CIA impact warrants prompt action on exposed devices.
RemediationAI
No vendor-released patch identified at time of analysis, as Edimax did not respond to the reporter. As compensating controls, restrict access to the device's web management interface to trusted management VLANs or hosts and disable any WAN-side/remote administration option (trade-off: legitimate remote management becomes unavailable), enforce strong unique admin credentials since exploitation requires PR:L authentication, and place the extender behind a segmented SSID/VLAN to limit who can reach /goform/formConnectionSetting. Where feasible, replace the EW-7438RPn with a supported model, as continued use of an end-of-support device with public exploit code and no vendor response represents ongoing risk; monitor https://vuldb.com/vuln/365440 and https://nvd.nist.gov/vuln/detail/CVE-2026-9459 for any future firmware update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a consumer/SOHO Wi-Fi range extender whose web management interface exposes /goform/ endpoints implemented in native code. The vulnerable handler formConnectionSetting fails to bound-check the max_Conn and timeOut parameters before copying them into a fixed-size stack buffer, matching CWE-121 (Stack-based Buffer Overflow). On embedded MIPS/ARM router firmware, such overflows typically overwrite the saved return address and can lead to arbitrary code execution as the web server process, which generally runs with high privileges on the device.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in Edimax EW-7438RPn 1.31. This affects the function formConnectionSetting of the file /goform/formConnectionSetting. Performing a manipulation of the argument max_Conn/timeOut results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn wireless range extenders (firmware 1.31) are vulnerable to remote exploitation that could disrupt device operation, intercept network traffic, or enable attacker access to the network. Publicly available exploit code exists, the vendor has not released patches, and these devices are widely deployed in enterprise networks.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access via firewall blocking of /goform/formConnectionSetting requests, disable remote management features if available, implement network segmentation to isolate affected devices from internet access, and accelerate replacement with patched alternatives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB