Which versions of Edimax EW-7478APC are affected by EUVD-2026-40074?

The Edimax EW-7478APC wireless access point (firmware 1.04) contains a stack-based buffer overflow vulnerability exploitable by authenticated remote attackers, with publicly available exploit code…

How to fix or mitigate EUVD-2026-40074?

24 hours: Identify and inventory all Edimax EW-7478APC devices running firmware 1.04; immediately restrict administrative access to trusted personnel and networks only; disable remote management where not required. 7 days: Implement network segmentation isolating affected devices from critical systems; deploy L2TP traffic monitoring for suspicious activity; complete exposure assessment. 30 days: Execute replacement of all affected units with patched access point models, or decommission and migrate to vendor-supported alternatives.

Edimax EW-7478APC EUVD-2026-40074

Q: What is the CVSS score of EUVD-2026-40074?

EUVD-2026-40074 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-13563 HIGH

Buffer Overflow (CWE-119)

2026-06-29 cna@vuldb.com

GHSA-2fx5-835p-hm49

Buffer Overflow

7.4

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web handler (AV:N/AC:L) requiring authenticated low-privilege access (PR:L); memory corruption yields full code-execution impact, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 12:31 vuln.today

DescriptionCVE.org

A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in the Edimax EW-7478APC (firmware 1.04) wireless access point lets an authenticated remote attacker corrupt memory by sending an oversized L2TPUserName argument to the formL2TPSetup handler at /goform/formL2TPSetup. Publicly available exploit code exists, though it is not listed in CISA KEV and carries a CVSS 4.0 base score of 7.4. The vendor was notified but did not respond, leaving the flaw unpatched.

Technical ContextAI

The EW-7478APC is a SOHO/small-business wireless access point. The vulnerability lives in its embedded HTTP administration server, specifically the formL2TPSetup function that processes POST requests configuring L2TP VPN client settings. The L2TPUserName parameter is copied into a fixed-size stack buffer without proper bounds checking, the classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) root cause. On the MIPS/ARM-class processors typical of these devices, overflowing the saved return address on the stack can redirect execution. No CPE strings were provided in the input, so the only confirmed affected build is firmware version 1.04 as stated in the description.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor was contacted before disclosure and did not respond, so no fixed firmware version exists to cite. As compensating controls: restrict access to the device's web administration interface to a trusted management VLAN or specific admin IPs and ensure it is never reachable from the WAN/Internet (the primary control, with the trade-off of requiring on-network access for administration); change all default and weak credentials to raise the PR:L barrier the attack depends on; and if the L2TP VPN client feature is not used, avoid exposing or configuring it. Monitor the VulDB entry (https://vuldb.com/cve/CVE-2026-13563) and the disclosure write-up for any future firmware fix, and consider replacing the device if the vendor remains unresponsive, since unpatched memory-corruption flaws in network gear tend to accumulate.