EUVD-2026-60002
GHSA-3xmw-9fqv-62rq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web interface (AV:N), low complexity exploit (AC:L), low-privilege auth required (PR:L), no user interaction, scope change due to subsequent-system impact (S:C), full CIA impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Remote buffer overflow in Edimax EW-7478APC firmware 1.04 allows network-authenticated attackers to corrupt memory via the selSSID argument in the formWlSiteSurvey handler, with potential for arbitrary code execution on both the vulnerable device and downstream systems. The CVSS 4.0 vector scores this at 8.6 with full high-impact triad across both vulnerable and subsequent systems, reflecting the embedded device context where exploitation typically yields root-level access. A public exploit exists (CVSS 4.0 E:P confirmed), and the vendor has not responded to coordinated disclosure, meaning no patch is available or expected in the near term.
Technical ContextAI
The Edimax EW-7478APC is a consumer/SMB-grade wireless access point and range extender running an embedded firmware stack (version 1.04). The vulnerable code path is the formWlSiteSurvey CGI handler located at /goform/formWlSiteSurvey, which processes the selSSID POST parameter as part of a wireless site survey (SSID selection) workflow. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) indicates that the function copies or processes the selSSID argument without adequate bounds checking, allowing an attacker to write beyond a fixed-size stack or heap buffer. On embedded MIPS/ARM platforms common to this class of device, such overflows often overwrite return addresses or function pointers directly, as stack protections, ASLR, and NX bits are frequently absent or weakly implemented in legacy embedded firmware. The scope change indicated by the CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) suggests that code execution on this device could affect systems on the network it bridges or extends.
RemediationAI
No vendor-released patch has been identified at time of analysis. The vendor was contacted prior to disclosure and did not respond, and no advisory or firmware update is available from Edimax. As a compensating control, restrict access to the device's web management interface exclusively to trusted internal VLANs or management networks using firewall rules or ACLs - this prevents remote network exploitation even with valid credentials. Disabling the wireless site survey feature entirely (if configurable) would remove the vulnerable code path. Where possible, replace EW-7478APC devices with actively maintained alternatives that receive security updates. Do not expose the management interface to untrusted networks or the internet. Change all default administrative credentials immediately to reduce the risk of low-privilege authentication being trivially satisfied. Monitor for unexpected traffic from or through these devices as an indicator of compromise. References: https://vuldb.com/vuln/391138, https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formWlSiteSurvey-34b53a41781f804fb328d87416095401
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today