EUVD-2026-40125
GHSA-pfpf-9r26-33qm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable OS command injection with low-priv auth breaks out to OS scope, justifying S:C and C:H/I:H/A:H regardless of provided Low-impact scoring.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in the Edimax EW-7478APC wireless access point firmware 1.04 allows a network-reachable authenticated attacker to execute arbitrary OS commands on the device by manipulating the rootAPmac parameter in POST requests to /goform/formStaDrvSetup. A public proof-of-concept exploit is available, indexed by VulDB and documented externally, and the vendor did not respond to responsible disclosure - making a vendor-released patch unlikely in the near term. The provided CVSS 4.0 score of 2.1 appears to significantly understate actual impact, as OS command injection on embedded Linux network devices typically yields full device compromise rather than the 'Low' impact across all three dimensions assigned in the vector.
Technical ContextAI
The vulnerability exists in the formStaDrvSetup C function within the device's CGI-based web management firmware, which handles POST requests to the /goform/formStaDrvSetup endpoint. The rootAPmac argument - designed to accept a MAC address for WDS/repeater station driver configuration - is passed directly into a shell execution context without sanitization, constituting a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The Edimax EW-7478APC is an 802.11ac wireless access point and range extender running embedded Linux firmware. CPE string cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the entire firmware line may be affected rather than solely version 1.04. Shell metacharacters such as semicolons, backticks, or pipe symbols injected into the rootAPmac value break out of the intended MAC address context and execute as OS-level commands.
RemediationAI
No vendor-released patch is available at time of analysis; the vendor did not respond to responsible disclosure, and no fix version has been identified. As the primary compensating control, immediately restrict access to the device's web management interface (typically TCP port 80/443) using firewall rules or ACLs so that only trusted management hosts or VLANs can reach the admin panel - this eliminates network-reachable exploitation by blocking the attack vector. Disable remote management features if they are enabled, as these expose the vulnerable endpoint to broader networks. Enforce strong, non-default credentials on the management interface to raise the cost of the required low-privilege authentication step. For security-sensitive environments, consider replacing the EW-7478APC with a supported device from a vendor with an active security response program. Monitor VulDB (https://vuldb.com/cve/CVE-2026-13581) for any future vendor patch release. The primary trade-off of network segmentation is reduced out-of-band management convenience.
More in Ew 7478Apc
View allStack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution again
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory by s
Remote buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets an authenticated attacker cor
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers overflow a buffer b
Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbit
Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS comma
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today