89
CVEs
2
Critical
44
High
0
KEV
89
PoC
46
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
44
MEDIUM
4
LOW
39
Monthly CVE Trend
Affected Products (28)
Ew 7438Rpn
24
Br 6675Nd
12
Br 6478Ac
10
Re11S Firmware
8
Br 6478ac V3 Firmware
8
Ew 7478Apc
7
Ew 7438rpn Mini Firmware
7
Br 6428Ns
7
Br 6208ac Firmware
6
Br 6476Ac Firmware
5
Br 6478Ac V2
5
Br 6208Ac V1 Firmware
3
Br 6288Acl Firmware
3
Br 6428Ns Firmware
3
Ic 3140W Firmware
3
Br 6214K
2
Ic 5150W Firmware
2
Br 6208Ac
2
Br 6428Nc
2
Open Redirect
2
Ic 6220Dc Firmware
2
Br 6473Ax Firmware
1
Ic 7100 Firmware
1
Cv 7428Ns Firmware
1
Edimax Ew 7438Rpn V2 Firmware
1
Br 6228Nc
1
Ic 3116W Firmware
1
Br 6258N Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2020-37125 | Unauthenticated remote code execution via OS command injection in Edimax EW-7438RPn-v3 Mini wireless extender firmware 1.27. EPSS 1.3% with PoC available. | CRITICAL | 9.8 | 1.3% | 70 |
PoC
No patch
|
| CVE-2025-70161 | EDIMAX BR-6208AC V2 router allows command injection through the pppUserName field via system() without sanitization. PoC available. | CRITICAL | 9.8 | 0.5% | 70 |
PoC
No patch
|
| CVE-2026-19959 | Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2020-37149 | Ew-7438Rpn Mini Firmware versions up to 1.27 is affected by cross-site request forgery (csrf) (CVSS 8.1). | HIGH | 8.1 | 0.0% | 61 |
PoC
No patch
|
| CVE-2025-56706 | Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.0 | 0.2% | 60 |
PoC
No patch
|
| CVE-2020-37150 | Ew-7438Rpn Mini Firmware versions up to 1.27 contains a vulnerability that allows attackers to access the /wizard_reboot (CVSS 7.5). | HIGH | 7.5 | 0.3% | 58 |
PoC
No patch
|
| CVE-2020-37097 | Ew-7438Rpn Mini Firmware versions up to 1.13 is affected by insufficiently protected credentials (CVSS 7.5). | HIGH | 7.5 | 0.0% | 58 |
PoC
No patch
|
| CVE-2026-12806 | Stack/heap buffer overflow in the Edimax BR-6478AC V2 wireless router (firmware 1.23) lets an authenticated attacker corrupt memory by sending an oversized selSSID parameter to the formWlSiteSurvey handler under /goform/, enabling denial of service and potentially arbitrary code execution on the device. Publicly available exploit code exists, but no public exploit identified at time of analysis as actively used in attacks (not in CISA KEV); the vendor was notified and did not respond, leaving devices unpatched. CVSS 4.0 base score is 7.4 reflecting network reachability of the management interface combined with required low-privilege authentication. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-13583 | Buffer overflow in the Edimax EW-7478APC wireless access point (firmware 1.04) lets remote attackers corrupt memory by sending an oversized ShareName or SelectName argument to the formUSBFolder handler at /goform/formUSBFolder. The flaw is reachable over the network and publicly available exploit code exists, though no active exploitation has been reported. Per the CVSS 4.0 vector it requires low-level authentication (PR:L) but yields full confidentiality, integrity, and availability impact on the device. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-9345 | Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware versions up to 1.31 enables authenticated remote attackers to execute arbitrary code by sending malformed parameters to the device configuration interface. The vulnerability affects the formWizSurvey function in /goform/formWizSurvey when processing ssid, manualssid, ip, mask, or gateway parameters, with publicly available exploit code existing on GitHub. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-9346 | Buffer overflow in Edimax EW-7438RPn WiFi range extender firmware up to version 1.31 enables authenticated remote attackers to execute arbitrary code via crafted POST requests to the wireless table management interface. The vulnerability affects the formWirelessTbl function when processing the submit-url parameter, with publicly available exploit code on GitHub demonstrating the attack method. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-7684 | Buffer overflow in Edimax BR-6428nC router firmware (version 1.16 and earlier) allows authenticated remote attackers to execute arbitrary code via crafted pptpDfGateway parameter in the /goform/setWAN endpoint. A public proof-of-concept exploit exists demonstrating stack overflow exploitation. EPSS data not available, but the combination of remote attack vector, low complexity, and published exploit code indicates elevated real-world risk for exposed devices with default credentials. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-7685 | Buffer overflow in Edimax BR-6208AC router firmware version 1.02 allows authenticated remote attackers to achieve complete system compromise via crafted pptpDfGateway parameter to /goform/setWAN endpoint. Public exploit code exists (EPSS probability unknown, not in CISA KEV). The vendor was notified but did not respond, leaving users without official remediation guidance. Attack requires only low-privilege authentication (PR:L) with network access and low complexity (AC:L), making this readily exploitable against internet-exposed management interfaces. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-8775 | Stack buffer overflow in the Edimax BR-6428NS router firmware version 1.10 allows authenticated remote attackers to corrupt memory by sending a crafted POST request to the formL2TPSetup handler with an oversized L2TPUserName parameter. Publicly available exploit code exists via a third-party Notion writeup, and the vendor was contacted but did not respond, leaving devices exposed without a coordinated fix. No CISA KEV listing or EPSS data is available to confirm active mass exploitation, but the combination of a public PoC and unresponsive vendor elevates real-world risk for any internet-exposed device. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-8776 | Stack buffer overflow in the Edimax BR-6428NS router (firmware 1.10) allows remote authenticated attackers to corrupt memory by sending an overlong pptpUserName parameter to the /goform/formPPTPSetup endpoint. Publicly available exploit code exists per VulDB disclosure, and no public exploit identified at time of analysis in CISA KEV. The vendor was reportedly contacted prior to disclosure but did not respond, leaving the device line without a confirmed fix. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|