EUVD-2026-31711
GHSA-434w-2p2w-phjf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manipulation of the argument submit-url leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote attackers to corrupt memory via the submit-url parameter of the formLogout handler at /goform/formLogout. Publicly available exploit code exists per VulDB disclosure, and the vendor failed to respond to coordinated disclosure, leaving the device unpatched. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have network reachability to the device's HTTP administration interface (typically only the LAN/WLAN, not the WAN by default) and must hold valid low-privilege web-UI credentials per CVSS PR:L - meaning default credentials, reused/guessable passwords, or a prior credential leak are the realistic entry path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 scores this 7.4 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, meaning network-reachable, low-complexity exploitation requiring low-privilege authentication and yielding full confidentiality, integrity, and availability impact on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the same LAN as the extender (a guest on the Wi-Fi, a compromised endpoint on the network, or someone with default or reused admin credentials) authenticates to the web UI and issues a crafted POST to /goform/formLogout with an oversized submit-url parameter, overwriting the stack and redirecting execution to shellcode or a ROP chain in the request body. With Technical Impact: total per SSVC, successful exploitation yields code execution in the context of the web management process - typically root on this class of embedded Linux device - enabling persistent backdoors, DNS hijacking, or recruitment into IoT botnets. … |
| Remediation | No vendor-released patch identified at time of analysis - Edimax did not respond to coordinated disclosure per the VulDB report at https://vuldb.com/vuln/365460. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Edimax EW-7438RPn devices across the organization and identify which networks they serve; restrict device internet access if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today