Which versions of Edimax EW-7438RPn are affected by EUVD-2026-31716?

The Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) is vulnerable to a remotely exploitable stack-based buffer overflow reachable by authenticated users.

Is there a public PoC exploit available for EUVD-2026-31716?

Yes, a public proof-of-concept exploit is available for EUVD-2026-31716. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-31716?

Within 24 hours: inventory all deployed Edimax EW-7438RPn devices and verify firmware version 1.31 presence. Within 7 days: restrict network access to device management interfaces and disable the formStats endpoint where operationally feasible. Within 30 days: contact Edimax support for patch timeline, evaluate replacement devices with active vendor support, and implement endpoint monitoring for exploitation attempts.

Edimax EW-7438RPn EUVD-2026-31716

Q: What is the CVSS score of EUVD-2026-31716?

EUVD-2026-31716 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-9481 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-25 VulDB

GHSA-2444-737h-93cr

Stack Overflow Buffer Overflow Ew 7438Rpn

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:54 vuln.today

CVSS changed

May 26, 2026 - 19:37 NVD

8.8 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7438RPn Wi-Fi range extender (firmware 1.31) allows remote authenticated attackers to corrupt memory by submitting an oversized 'submit-url' argument to the formStats handler at /goform/formStats. Publicly available exploit code exists (VulDB-published PoC on GitHub), though EPSS estimates exploitation probability at only 0.04%. The vendor was notified but has not responded, leaving deployed devices without an official fix.

Technical ContextAI

The EW-7438RPn is a consumer-grade Wi-Fi range extender whose web administration interface is implemented as CGI-style handlers (the /goform/* routes) typical of embedded Realtek/Broadcom SDK firmware. CWE-121 (stack-based buffer overflow) here means the formStats handler copies the user-controlled 'submit-url' parameter into a fixed-size stack buffer without bounds checking, overwriting the saved return address or adjacent stack frame data. On MIPS/ARM-based SOHO routers like this one, such overflows are commonly leveraged to hijack control flow because these devices typically lack ASLR, stack canaries, and NX protections in their firmware builds.

RemediationAI

No vendor-released patch identified at time of analysis - Edimax did not respond to the coordinated disclosure attempt. Until a firmware update is published, administrators should restrict access to the device's web administration interface to trusted management hosts only (firewall the device's HTTP/HTTPS admin port to LAN-side admin VLANs), disable remote/WAN-side management if enabled, and change any default credentials to strong unique passwords to raise the bar against the PR:L exploitation prerequisite. As a stronger mitigation, retire the EW-7438RPn from production use given its consumer-grade status and unresponsive vendor; replacement with a currently-supported extender is the most durable fix. Monitor the VulDB advisory (https://vuldb.com/vuln/365462) for any future firmware update notice. Side effect of access restriction: legitimate remote management workflows will break and must be migrated to VPN-based access.