EUVD-2026-31680
GHSA-68hc-jq62-w8v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web UI on LAN/WAN
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend POST to /goform/formRadius with oversized submit-url
-
ExecutionOverflow stack buffer in formRadius handler
-
PersistHijack saved return address for code execution
-
ImpactGain root on extender and pivot/intercept traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's HTTP management interface (TCP port 80 by default) and low-privileged authentication to the web UI (CVSS PR:L), with the attacker sending a crafted POST to the /goform/formRadius endpoint containing an oversized submit-url parameter. The affected build is specifically Edimax EW-7438RPn firmware 1.31; no user interaction is required (UI:N) and attack complexity is low (AC:L). Realistic exploitation is limited to scenarios where the admin interface is reachable by the attacker - typically the LAN or wireless segment, or any deployment where WAN-side administration is enabled - and where credentials are known, weak, or default. |
| Impact | Signals are mixed. CVSS 4.0 rates this 7.4 (High) with AV:N/AC:L/PR:L/UI:N and high confidentiality, integrity, and availability impact, and the SSVC framework records total technical impact with a public PoC, though automatable=no suggests it is not yet wormable. EPSS is very low at 0.04% (13th percentile), and the device is not on CISA KEV, which is consistent with a niche consumer/SOHO target rather than mass exploitation. The PR:L requirement and the fact that the management interface is typically LAN-only meaningfully constrain real-world exposure - however, any extender whose admin UI is reachable from the WAN, or any attacker already on the wireless segment with valid (or default) credentials, faces a credible path to full device compromise. Treat this as high priority where the device is internet-exposed or used in untrusted networks, and lower priority where it sits behind a trusted LAN. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege web UI credentials - via default passwords, phishing, or a foothold on the LAN - sends a crafted POST to /goform/formRadius with an oversized submit-url parameter, overflowing a stack buffer in the formRadius handler. Using the publicly available PoC at github.com/wudipjq/my_vuln, they crash the management daemon and, with embedded-device exploitation techniques, can pivot to arbitrary code execution as root on the extender, enabling traffic interception or use of the device as a persistent network foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated attackers to corrupt memory by sending an oversized submit-url parameter to the formRadius handler at /goform/formRadius. Publicly available exploit code exists, and the vendor did not respond to coordinated disclosure attempts, leaving the device without a confirmed fix. EPSS probability is currently low (0.04%), but the combination of a public PoC, total technical impact, and unpatched status warrants urgent attention for any deployed units.
RemediationAI
No vendor-released patch identified at time of analysis, as Edimax did not respond to the coordinated disclosure. In the absence of a firmware update, restrict access to the device's web management interface to a trusted management VLAN or host, disable remote/WAN administration if enabled (trade-off: loss of off-LAN management), and change default and weak admin credentials since exploitation requires PR:L. Where feasible, segment the extender onto an isolated SSID/VLAN and monitor for unexpected reboots or configuration changes; for end-of-support deployments, plan replacement with a currently supported device. Track the VulDB advisory at https://vuldb.com/vuln/365442 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-9461 for any future vendor response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a SOHO Wi-Fi range extender whose embedded web management interface exposes CGI-style endpoints under /goform/. The vulnerable formRadius handler parses the submit-url HTTP parameter into a fixed-size stack buffer without adequate bounds checking, the classic CWE-121 (Stack-based Buffer Overflow) pattern common in MIPS/ARM embedded BusyBox-style web daemons. On such devices the web server typically runs as root with no ASLR or stack canaries, so corruption of the saved return address can be steered toward arbitrary code execution or, at minimum, a reliable crash of the management plane.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. Affected is the function formRadius of the file /goform/formRadius. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) contains a remotely exploitable stack buffer overflow that can corrupt device memory, with publicly available exploit code circulating and no vendor patch available. Authenticated attackers can compromise the integrity and availability of wireless network segments where these devices are deployed. Organizations using this model face forced remediation and must immediately identify affected units to prevent network compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict management interface access via firewall rules and network segmentation, (2) isolate affected extenders from critical business network segments, (3) monitor for exploitation via network IDS/IPS and extender logs for buffer overflow indicators, (4) disable remote management protocols where operationally feasible, (5) create hardware replacement schedule with procurement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileg
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB