EUVD-2026-31713
GHSA-3h8q-f835-m698
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EW-7438RPn web interface
-
DeliveryAuthenticate with low-priv credentials
-
ExploitSend crafted POST to /goform/formrefresh
-
ExecutionOverflow stack via submit-url parameter
-
PersistOverwrite saved return address
-
ImpactExecute shellcode on extender
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must reach the device's HTTP management interface (typically LAN-side on consumer range extenders) and possess low-privilege credentials to the web UI as required by CVSS PR:L. The specific vulnerable endpoint is /goform/formrefresh on Edimax EW-7438RPn firmware 1.31, and the trigger is an oversized or crafted submit-url parameter passed to the formrefresh function - exploitation is limited to this exact model and firmware revision. No user interaction is required (UI:N), but exposure is naturally constrained by whether the admin panel is reachable from the attacker's network position and whether default or weak credentials permit authentication. |
| Impact | The signals are mixed: CVSS 4.0 rates the issue 7.4 (High) with network attack vector, low complexity, and high impact to confidentiality, integrity, and availability, yet requires low privileges (PR:L) - meaning an authenticated session to the web admin interface is needed. EPSS is very low at 0.04% (13th percentile), and SSVC marks exploitation as 'poc' with Automatable:no and Technical Impact:total, indicating manual targeted exploitation is feasible but not at scale. Publicly available exploit code exists (GitHub PoC by wudipjq), but the CVE is not in CISA KEV, so this is no public exploit identified as actively exploited in the wild. Practical risk is highest where the admin panel is exposed to untrusted networks (LAN with weak/default credentials, or rare WAN-exposed management) - for hardened deployments with strong admin credentials and LAN-only management, real-world risk is meaningfully lower than the 7.4 score suggests. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the device's web management interface - for example, a guest or compromised LAN user who has obtained or guessed admin-tier credentials - sends a crafted HTTP request to /goform/formrefresh with an oversized submit-url parameter, triggering the stack overflow in formrefresh. Because publicly available exploit code exists (PoC published at github.com/wudipjq/my_vuln), an attacker can reproduce the crash or, with additional exploit development against this embedded target, attempt code execution to pivot into the local network or persist on the extender. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 Wi-Fi range extender allows remote attackers with low privileges to corrupt memory via the submit-url parameter handled by the formrefresh function at /goform/formrefresh. Publicly available exploit code exists per VulDB, though EPSS scoring (0.04%) suggests limited mass exploitation activity, and the vendor has not responded to the disclosure, leaving devices without an official fix.
RemediationAI
No vendor-released patch identified at time of analysis - VulDB explicitly notes Edimax was contacted early but did not respond. As compensating controls, restrict access to the device's web administration interface to a dedicated management VLAN or trusted hosts only (trade-off: administrators must connect from approved networks), ensure WAN-side remote management is disabled (the default for most SOHO devices, but verify), change default admin credentials and use strong passwords to raise the bar against the PR:L authentication requirement, and consider replacing the device if it is at end-of-life or deployed in sensitive environments. Monitor https://vuldb.com/vuln/365461 and the Edimax support site for any future firmware update addressing /goform/formrefresh input validation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Edimax EW-7438RPn is a consumer-grade Wi-Fi range extender whose embedded web management interface exposes a CGI-style handler at /goform/formrefresh. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), meaning the formrefresh function copies attacker-controlled data from the submit-url HTTP parameter into a fixed-size stack buffer without proper bounds checking. On embedded MIPS/ARM platforms typical of this device class, such overflows can corrupt the saved return address and potentially redirect execution, though mitigations like stack canaries and ASLR are often absent in low-cost SOHO firmware. The CPE cpe:2.3:a:edimax:ew-7438rpn confirms the issue is scoped to this specific extender model.
Know when Ew 7438Rpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of the argument submit-url results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Edimax EW-7438RPn Wi-Fi range extenders (version 1.31) contain a remotely exploitable stack-based buffer overflow that allows low-privilege attackers to corrupt device memory and potentially execute arbitrary commands; publicly available exploit code exists. With no vendor-released patch available, affected devices deployed across organizational networks represent persistent security gaps that could enable lateral movement into critical systems. Organizations using these extenders face unmitigated risk until hardware replacement is completed.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation isolating vulnerable devices to restricted VLANs with no access to critical systems; (2) firewall rules blocking external and internal access to /goform/formrefresh endpoint; (3) IP-based ACLs restricting all management interface access; (4) enhanced network monitoring and IDS/IPS rules detecting exploitation attempts targeting the submit-url parameter; (5) expedited hardware replacement as primary remediation path.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Ew 7438Rpn
View allBuffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attack
Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attac
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privi
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows authenticated remote at
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 range extender allows remote authenticated attackers to corrup
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender enables remote low-privileged attacker
Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated at
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 range extenders allows authenticated remote attackers to corrupt m
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Stack-based buffer overflow in Edimax EW-7438RPn 1.31 wireless range extenders allows remote authenticated attackers to
Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low privi
Exploit-DB