EUVD-2026-31676
GHSA-jhff-593j-8ffm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed EW-7438RPn web UI
-
DeliveryAuthenticate with weak/default credentials
-
ExploitPOST oversized submit-url to /goform/formAccept
-
InstallOverflow stack buffer in formAccept
-
C2Hijack return address to shellcode
-
ExecuteExecute commands as root
-
ImpactPivot into LAN or recruit to botnet
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network-layer reachability to the EW-7438RPn web administration interface on the LAN or, if remote management is enabled, over the WAN; (2) valid low-privilege web UI credentials per CVSS PR:L - default credentials qualify and are commonly unchanged on consumer extenders; (3) the device running firmware version 1.31 as identified in EUVD-2026-31676; and (4) the ability to send a crafted HTTP request to the /goform/formAccept endpoint with an oversized submit-url argument. No user interaction is required (UI:N). Exploitation is limited by the fact that most EW-7438RPn units are deployed behind NAT on residential networks without exposed management interfaces, and by the PR:L authentication barrier - although weak default credentials substantially erode that limit. |
| Impact | The CVSS 4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact over an adjacent web management interface that requires low privileges (PR:L) but no user interaction, with proof-of-concept exploit maturity (E:P). However, the EPSS score of 0.04% (13th percentile) is extremely low and the vulnerability is not on the CISA KEV list, indicating no observed mass exploitation despite a public PoC - consistent with the limited internet exposure of a niche consumer range extender. The conflicting signals (public exploit + unresponsive vendor versus low EPSS and no KEV) suggest this is a real but narrow-targeting risk: opportunistic botnet operators could weaponize the PoC against exposed devices, but most EW-7438RPn units sit behind NAT on residential LANs, limiting realistic attack surface. The PR:L authentication requirement materially limits exploitation to attackers who already have valid (or default) management credentials. |
| Exploit ScenarioDerived | An attacker who has obtained low-privileged web UI credentials (default, weak, or phished) on a reachable EW-7438RPn issues an HTTP POST to /goform/formAccept with an oversized submit-url parameter crafted to overwrite the saved return address on the stack. Using the published PoC at github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_13/13.md as a template, the attacker pivots execution to shellcode placed in the request body, gaining a root shell on the extender and using it as a foothold to pivot into the LAN, sniff Wi-Fi traffic, or enroll the device into a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt memory by sending a crafted submit-url parameter to the formAccept handler at /goform/formAccept. Publicly available exploit code exists (VulDB-disclosed, with a PoC published on GitHub), but EPSS rates real-world exploitation probability at only 0.04% (13th percentile) and the vendor has not responded to disclosure, leaving the device permanently exposed.
RemediationAI
No vendor-released patch identified at time of analysis - the disclosing party (VulDB) reports the vendor did not respond. As compensating controls, restrict access to the device's web management interface to a trusted management VLAN or specific source IP via firewall rules (side effect: legitimate remote administration breaks and configuration must be done on-LAN), ensure the default administrator password is changed to a strong unique value to keep the PR:L barrier meaningful, and consider replacing the EW-7438RPn with a supported range extender from a vendor with active firmware maintenance, since unresponsive disclosure suggests the device is end-of-support. Monitor the VulDB advisory (https://vuldb.com/vuln/365441) for any future firmware update notice.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a consumer Wi-Fi range extender whose web administration interface is implemented through CGI-style goform handlers compiled into the device firmware (cpe:2.3:a:edimax:ew-7438rpn:*). The flaw is a classic CWE-121 stack-based buffer overflow: the formAccept routine that processes the /goform/formAccept endpoint copies the attacker-controlled submit-url HTTP argument into a fixed-size stack buffer without enforcing length bounds, overwriting saved return addresses or adjacent local variables. On embedded MIPS/ARM SOHO devices like this one, lack of ASLR, NX, and stack canaries typically makes such overflows directly exploitable for arbitrary code execution at the privilege level of the httpd process (commonly root).
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn WiFi range extenders (versions up to 1.31) contain a remotely exploitable buffer overflow allowing authenticated attackers to corrupt device memory and potentially compromise network infrastructure. With publicly available exploit code, no vendor-released patch, and an unresponsive vendor, organizations using these devices face unremediable security risk.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation isolating affected devices to a restricted-access VLAN; disable remote management features where possible; restrict administrative access via access control lists; monitor administrative interfaces for unauthorized access attempts; develop device replacement roadmap as the only sustainable remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB