EUVD-2026-60001
GHSA-537x-x5h3-6q98
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible command injection with low-privilege credentials grants full OS command execution on embedded firmware, yielding high C/I/A; scope unchanged as impact is confined to the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the rootAPmac parameter submitted to the /goform/formWlbasic CGI endpoint. A public proof-of-concept exploit has been disclosed via VulDB and a linked Notion page. The vendor did not respond to coordinated disclosure, leaving no patch available and the exposure window indefinite.
Technical ContextAI
The EW-7478APC is a wireless access point running embedded Linux firmware with a web-based CGI management interface. The vulnerability resides in the formWlbasic function at the /goform/formWlbasic endpoint, where the rootAPmac argument - likely representing a MAC address input for root AP association - is incorporated into an OS-level command string without adequate sanitization. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies this as a classic pattern in embedded firmware where CGI handlers pass web form parameters directly to shell commands or system() calls. The CPE string cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:* uses a wildcard version, indicating no official vendor scoping has bounded the affected firmware range beyond what the researcher tested (version 1.04).
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As the primary compensating control, restrict access to the device's web management interface to trusted, isolated management VLANs and block all inbound access from untrusted or internet-facing network segments; this eliminates network reachability for unauthenticated parties and limits the PR:L attack surface to already-trusted administrators only. Disabling remote management features (if exposed to WAN) reduces the attack surface further, though the trade-off is loss of remote administration capability. Consider replacing the EW-7478APC with a currently-supported access point model from a vendor with an active security response program if the device is in a security-sensitive environment. Monitor https://vuldb.com/vuln/391137 and the Edimax product page for any forthcoming firmware updates.
More in Ew 7478Apc
View allStack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution again
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory by s
Remote buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets an authenticated attacker cor
Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers overflow a buffer b
Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbit
OS command injection in the Edimax EW-7478APC wireless access point firmware 1.04 allows a network-reachable authenticat
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today