EUVD-2026-31676
GHSA-jhff-593j-8ffm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in Edimax EW-7438RPn 1.31. This impacts the function formAccept of the file /goform/formAccept. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt memory by sending a crafted submit-url parameter to the formAccept handler at /goform/formAccept. Publicly available exploit code exists (VulDB-disclosed, with a PoC published on GitHub), but EPSS rates real-world exploitation probability at only 0.04% (13th percentile) and the vendor has not responded to disclosure, leaving the device permanently exposed.
Technical ContextAI
The Edimax EW-7438RPn is a consumer Wi-Fi range extender whose web administration interface is implemented through CGI-style goform handlers compiled into the device firmware (cpe:2.3:a:edimax:ew-7438rpn:*). The flaw is a classic CWE-121 stack-based buffer overflow: the formAccept routine that processes the /goform/formAccept endpoint copies the attacker-controlled submit-url HTTP argument into a fixed-size stack buffer without enforcing length bounds, overwriting saved return addresses or adjacent local variables. On embedded MIPS/ARM SOHO devices like this one, lack of ASLR, NX, and stack canaries typically makes such overflows directly exploitable for arbitrary code execution at the privilege level of the httpd process (commonly root).
RemediationAI
No vendor-released patch identified at time of analysis - the disclosing party (VulDB) reports the vendor did not respond. As compensating controls, restrict access to the device's web management interface to a trusted management VLAN or specific source IP via firewall rules (side effect: legitimate remote administration breaks and configuration must be done on-LAN), ensure the default administrator password is changed to a strong unique value to keep the PR:L barrier meaningful, and consider replacing the EW-7438RPn with a supported range extender from a vendor with active firmware maintenance, since unresponsive disclosure suggests the device is end-of-support. Monitor the VulDB advisory (https://vuldb.com/vuln/365441) for any future firmware update notice.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today