EUVD-2026-40073
GHSA-7257-9x75-2ph5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable goform handler needs a low-privilege authenticated session (PR:L) and no user interaction; memory corruption yields full device C/I/A impact with unchanged scope.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in Edimax EW-7478APC 1.04. This affects the function formiNICSiteSurvey of the file /goform/formiNICSiteSurvey of the component POST Request Handler. This manipulation of the argument selSSID causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Memory corruption in the Edimax EW-7478APC wireless access point (firmware 1.04) lets a remote, low-privileged user overflow a buffer by submitting an oversized selSSID value to the /goform/formiNICSiteSurvey POST handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, leaving deployed devices without an official fix. Successful exploitation can crash the device or potentially run attacker-controlled code on the embedded firmware; there is no public exploit identified as actively exploited (not in CISA KEV) and no EPSS score was provided.
Technical ContextAI
The EW-7478APC is an embedded wireless access point/range-extender whose web management interface uses goform CGI handlers to process configuration POST requests. The vulnerable formiNICSiteSurvey function processes the selSSID argument (the SSID selected from a Wi-Fi site survey) and copies it into a fixed-size buffer without adequate bounds checking - the classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) root cause. On resource-constrained networking appliances such handlers are typically written in C with unsafe string operations (strcpy/sprintf), so an attacker-controlled SSID string longer than the destination buffer overwrites adjacent memory, corrupting the stack or heap of the privileged web-server process.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, and no fixed firmware version is published in the available data. As compensating controls, restrict the device's web management interface to a trusted management VLAN or specific admin IPs and ensure it is never reachable from the WAN (block inbound access to the HTTP/HTTPS admin port), which removes remote reachability at the cost of requiring on-site or VPN administration; enforce strong, non-default management credentials since exploitation needs an authenticated session (PR:L), reducing the chance an attacker obtains the required low-privilege access; and monitor for unexpected device crashes/reboots that may indicate overflow attempts. Track the researcher advisory (https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formiNICSiteSurvey-34b53a41781f8053af98c2127c476d66) and Edimax support for future firmware, and consider replacing the hardware if no fix materializes.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today