Edimax EW-7438RPn EUVD-2026-31711

The attacker must have network reachability to the device's HTTP administration interface (typically only the LAN/WLAN, not the WAN by default) and must hold valid low-privilege web-UI credentials per CVSS PR:L - meaning default credentials, reused/guessable passwords, or a prior credential leak are the realistic entry path. The specific request target is the formLogout handler at /goform/formLogout with an over-length submit-url argument. No user interaction is required (UI:N), and the affected configuration is the default firmware 1.31 install with no special feature toggles needed. Exploitation is limited to the EW-7438RPn model on firmware 1.31; devices not exposing the management interface to the attacker's network segment are not reachable.

CVSS 4.0 scores this 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, meaning network-reachable, low-complexity exploitation requiring low-privilege authentication and yielding full confidentiality, integrity, and availability impact on the device. SSVC corroborates this with Technical Impact: total but Automatable: no and Exploitation: poc, indicating a working proof-of-concept exists but no observed mass exploitation. EPSS is only 0.04% (13th percentile) and the CVE is not in CISA KEV, which is consistent with a niche consumer device that is unlikely to be scanned at internet scale but is trivially exploitable once reached - the low EPSS reflects population scarcity, not exploit difficulty. The PR:L requirement is a meaningful brake: an attacker needs valid (often default 'admin/1234' or similar) credentials, so the realistic risk is highest on devices exposed to the LAN by guests, on shared/public Wi-Fi, or where default credentials remain.

An attacker on the same LAN as the extender (a guest on the Wi-Fi, a compromised endpoint on the network, or someone with default or reused admin credentials) authenticates to the web UI and issues a crafted POST to /goform/formLogout with an oversized submit-url parameter, overwriting the stack and redirecting execution to shellcode or a ROP chain in the request body. With Technical Impact: total per SSVC, successful exploitation yields code execution in the context of the web management process - typically root on this class of embedded Linux device - enabling persistent backdoors, DNS hijacking, or recruitment into IoT botnets. Publicly available exploit code exists at https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_17/17.md, lowering the skill barrier.