Edimax EW-7478APC EUVD-2026-40131

Exploitation requires network access to the device's web management interface and valid authentication to reach the protected POST handler (CVSS PR:L indicates low-privilege credentials are needed - not unauthenticated). The specific trigger is a POST request to /goform/formUSBFolder invoking the formUSBFolder function with an oversized ShareName or SelectName argument, which is associated with the USB folder-sharing feature; environments where USB sharing is disabled or where the management interface is not reachable by the attacker are not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the authentication requirement and the device-local interface exposure are the key limiting factors.

Signals are mixed-to-moderate. The CVSS 4.0 base score is 7.4 (High) with network attack vector, low complexity, no attack requirements, and no user interaction, but it requires low privileges (PR:L), meaning the attacker must first authenticate to the management interface - a meaningful limiting factor. The vector reports high impact to confidentiality, integrity, and availability on the device (VC:H/VI:H/VA:H) with no scope change. Exploit maturity in the vector is E:P (proof-of-concept), consistent with a publicly disclosed POC. There is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation is not evidenced. The realistic risk is elevated for internet-exposed or shared-network devices where credentials are weak or default, but the authentication requirement and the niche nature of the product keep this below the priority of an unauthenticated, mass-exploitable flaw. Note: the vendor was contacted but did not respond, so no fix is confirmed - increasing residual risk for deployed units.

An attacker who has obtained valid (possibly low-privilege or default) credentials to the EW-7478APC web interface sends a crafted POST request to /goform/formUSBFolder with an overlong ShareName or SelectName value. The oversized input overflows the target buffer, crashing the management service or potentially executing attacker-controlled code on the device. Publicly available POC code lowers the barrier to reproducing this attack.