Which versions of Edimax EW-7438RPn are affected by EUVD-2026-31714?

Edimax EW-7438RPn wireless range extenders (firmware v1.31) contain a remotely-exploitable memory corruption vulnerability that could allow attackers with low-privilege network access to crash or…

Is there a public PoC exploit available for EUVD-2026-31714?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31714. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31714?

Within 24 hours: Conduct a network inventory to identify all Edimax EW-7438RPn devices running firmware version 1.31 and document their role in network architecture. Within 7 days: Either remove affected devices from production networks entirely or relocate them to isolated, low-trust network segments (e.g., guest Wi-Fi only, air-gapped from critical systems) with restricted management access. Within 30 days: Complete replacement of all EW-7438RPn v1.31 units with alternative vendor equipment that receives active security support and patches.

Edimax EW-7438RPn EUVD-2026-31714

Q: What is the CVSS score of EUVD-2026-31714?

EUVD-2026-31714 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9482 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-wxj6-68gg-rh5m

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:17 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn 1.31 wireless range extender allows remote attackers with low-privilege credentials to corrupt memory via a crafted submit-url parameter sent to the formSDHCP handler at /goform/formSDHCP. Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), but EPSS is only 0.04% and the vendor has not responded to coordinated disclosure, leaving the device unpatched.

Technical ContextAI

The EW-7438RPn is a consumer-grade Wi-Fi range extender whose web-based administration UI exposes CGI-style endpoints under /goform/, a common pattern in embedded Realtek/Boa-based router firmware. The vulnerability sits in the formSDHCP function, which handles static DHCP configuration submissions and copies the submit-url POST/GET parameter into a fixed-size stack buffer without bounds checking (CWE-121: Stack-Based Buffer Overflow). On MIPS/ARM SOHO devices this typically permits overwriting the saved return address, enabling control-flow hijack, though exploitability depends on whether stack canaries, ASLR, or NX are compiled into the firmware - historically Edimax extenders ship with minimal exploit mitigations.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to VulDB's coordinated disclosure, so users of EW-7438RPn 1.31 should treat the device as permanently unpatched and apply compensating controls. The most effective mitigation is to ensure the web administration interface is never exposed to the WAN (disable any 'remote management' option in the UI) and to restrict LAN access to the admin IP via firewall rules on an upstream router, accepting the trade-off that legitimate remote admin from outside the LAN becomes impossible. Rotate the admin password to a long unique value to raise the bar for the PR:L precondition, place the extender on an isolated SSID/VLAN segregated from user devices to limit who can reach /goform/formSDHCP, and where feasible replace the device with a currently-supported model since the silent vendor strongly suggests end-of-support. Monitor the VulDB entry (https://vuldb.com/vuln/365463) for any future firmware update.