Which versions of Edimax EW-7438RPn are affected by EUVD-2026-31682?

Edimax EW-7438RPn wireless range extenders (version 1.31) contain a remotely exploitable buffer overflow vulnerability in their web management interface that enables complete device compromise.

Is there a public PoC exploit available for EUVD-2026-31682?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31682. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31682?

Within 24 hours: Identify all Edimax EW-7438RPn v1.31 devices; restrict network access to the management interface to administrative IP ranges only via firewall rules; disable WPS functionality unless operationally required. Within 7 days: Contact Edimax support to confirm no patch is planned; begin procurement of replacement devices with demonstrated vendor security response; implement network segmentation to isolate affected devices. Within 30 days: Complete replacement of all affected devices or verify all compensating controls remain in place and are actively monitored for exploitation attempts.

Edimax EW-7438RPn EUVD-2026-31682

Q: What is the CVSS score of EUVD-2026-31682?

EUVD-2026-31682 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9462 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-5383-33xm-xf5w

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:37 vuln.today

CVSS changed

May 26, 2026 - 20:07 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability was detected in Edimax EW-7438RPn 1.31. Affected by this vulnerability is the function formWpsProxyEnable of the file /goform/formWpsProxyEnable. The manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attackers to compromise the device by supplying an oversized submit-url argument to the /goform/formWpsProxyEnable web management endpoint. Exploitation achieves full confidentiality, integrity, and availability impact on the device per CVSS VC:H/VI:H/VA:H, and a public proof-of-concept is available on GitHub. No vendor patch exists - Edimax did not respond to coordinated disclosure - though EPSS remains low at 0.04% (13th percentile) and the vulnerability is not listed in CISA KEV, suggesting limited observed exploitation despite the available POC.

Technical ContextAI

The affected component is the formWpsProxyEnable function, a CGI handler in the HTTP-based web management interface of the Edimax EW-7438RPn wireless range extender (firmware 1.31), identified by CPE cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:*. This handler processes WPS (Wi-Fi Protected Setup) proxy configuration via HTTP POST to /goform/formWpsProxyEnable. The root cause is CWE-121 (Stack-Based Buffer Overflow): the submit-url parameter is copied into a fixed-size stack buffer without adequate length validation, allowing an attacker to overwrite the stack frame including saved return addresses and control-flow data. Embedded router and range extender firmware commonly relies on C-based CGI handlers lacking memory-safe language protections; many such devices also omit stack canaries and ASLR, which significantly lowers the bar for reliable exploitation once a valid overflow primitive is achieved.

RemediationAI

No vendor-released patch has been identified at time of analysis - Edimax did not respond to the vulnerability disclosure, and no patched firmware version has been confirmed. Administrators should immediately restrict network access to the device's web management interface (typically TCP port 80/443) by placing firewall or ACL rules that permit management traffic only from explicitly trusted IP ranges; this trade-off reduces remote attack surface but limits management flexibility. If the WPS proxy feature is not required, disabling WPS entirely through any available alternative interface removes the vulnerable /goform/formWpsProxyEnable endpoint from the attack surface, though this eliminates WPS-based client onboarding. For high-risk environments, replacing the EW-7438RPn with an actively supported device from a vendor with a published security response process is the most durable remediation. Monitor VulDB entry https://vuldb.com/vuln/365443 for any future vendor patch or firmware release.