Edimax EW-7438RPn EUVD-2026-31682

Exploitation requires low-privileged authenticated access to the Edimax EW-7438RPn web management interface, confirmed by the CVSS 4.0 PR:L designation - some valid credentials are needed prior to exploitation. The device's web management interface must be network-accessible from the attacker's position (AV:N). The vulnerable handler is the WPS proxy configuration endpoint /goform/formWpsProxyEnable, meaning the web interface must not be blocked by intervening firewall rules. The SSVC assessment notes the attack is not automatable, indicating manual crafting of the exploit payload is required rather than a fully scripted, fire-and-forget approach. Scope is contained to the device itself (SC:N/SI:N/SA:N), so direct lateral movement to adjacent network systems is not a first-order consequence. No special non-default configuration beyond having the web interface reachable appears required - the vulnerable function is part of standard firmware operation.

The CVSS 4.0 score of 7.4 reflects network-accessible exploitation (AV:N) requiring only low privileges (PR:L), no attack complexity (AC:L), no additional preconditions (AT:N), and no user interaction (UI:N), with total impact on the vulnerable system. However, the EPSS score of 0.04% at the 13th percentile is very low, indicating this CVE is not being broadly exploited relative to the wider vulnerability population - likely reflecting the niche device footprint of a consumer-grade range extender rather than inherent exploit difficulty. The vulnerability does not appear in the CISA KEV catalog, confirming no verified mass exploitation at time of analysis. Critically, the SSVC framework rates technical impact as total while flagging the attack as not automatable, suggesting manual crafting or session-specific state is required and bulk scanning campaigns are unlikely. The CVSS E:P modifier and the GitHub POC corroborate proof-of-concept status. The combination of public exploit code, absent vendor patch, and total device-level impact represents a meaningful risk for any deployment where the web management interface is reachable from untrusted networks - the low EPSS should not induce complacency for exposed devices.

An attacker who has obtained low-privileged credentials to the Edimax EW-7438RPn web management interface - whether through default credentials, credential reuse, or prior compromise - sends a crafted HTTP POST request to /goform/formWpsProxyEnable with a submit-url value exceeding the stack buffer's capacity. Using the publicly available proof-of-concept at https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_15/15.md as a reference, the attacker overwrites the stack frame to redirect execution flow and achieves arbitrary code execution at the privilege level of the firmware web server process, effectively gaining full device control.