CVE-2026-13583
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formUSBFolder function of the /goform/formUSBFolder file. Manipulation of the ShareName/SelectName arguments in a POST request can cause a buffer overflow, enabling remote attack. The exploit has been publicly disclosed and may be used.
Risk Assessment
Remote exploitation could lead to device takeover, posing a risk to network security and sensitive data access. The vendor's lack of response increases the risk of exploitation.
Recommendation
Immediately disconnect the device from the network and contact the vendor for a firmware update. If no update is available, consider replacing the device with a supported model.
Other vulnerabilities in Edimax EW-7478APC
See all- CVE-2026-13582High
A buffer overflow vulnerability has been found in Edimax EW-7478APC version 1.04 in the formUSBAccount function of the /goform/formUSBAccount file. An attacker can remotely manipulate the UserName/Password arguments, causing a buffer overflow. The exploit has been published and may be used.
- CVE-2026-13580High
A buffer overflow vulnerability has been detected in the Edimax EW-7478APC version 1.04 in the formQoS function of the /goform/formQoS file. An attacker can remotely manipulate the selSSID argument, leading to a buffer overflow. The exploit has been publicly disclosed and may be used.
- CVE-2026-13564High
A stack-based buffer overflow vulnerability was found in the formPPPoESetup function of the /goform/formPPPoESetup file in Edimax EW-7478APC version 1.04. An attacker can remotely manipulate the pppUserName argument, causing a buffer overflow. The exploit has been made public and could be used.
- CVE-2026-13563High
A stack-based buffer overflow vulnerability was found in Edimax EW-7478APC version 1.04 in the formL2TPSetup function. An attacker can remotely manipulate the L2TPUserName argument, causing a buffer overflow. The exploit is public, and the vendor did not respond.
- CVE-2026-13561Medium
A vulnerability was found in Edimax EW-7478APC version 1.04, allowing OS command injection via the rootAPmac argument in the formiNICbasic function. The attack is remotely exploitable and the exploit is publicly available.
- CVE-2026-19961Critical
A vulnerability was detected in Edimax EW-7478APC 1.04. It affects the formWlSiteSurvey function in /goform/formWlSiteSurvey. Manipulating the selSSID argument causes a buffer overflow. The attack can be performed remotely and the exploit is public.
- CVE-2026-19959Critical
A weakness was identified in Edimax EW-7478APC 1.04. It affects the formWanTcpipSetup function in /goform/formWanTcpipSetup. Manipulating the pppUserName argument causes a stack-based buffer overflow. Remote exploitation is possible and the exploit is public.
- CVE-2026-19963High
A vulnerability was found in Edimax EW-7478APC 1.04. The issue affects the stainfo function in the file /goform/stainfo, where manipulation of the interface argument leads to command injection. The attack can be initiated remotely, and the exploit is publicly available.
- CVE-2026-19962High
A vulnerability was found in Edimax EW-7478APC 1.04. The issue affects the setWAN function in the file /goform/setWAN, where manipulation of pppUserName/pptpUserName/L2TPUserName arguments leads to command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-19960High
A security vulnerability was detected in Edimax EW-7478APC 1.04. It impacts the formWlbasic function in /goform/formWlbasic. Manipulating the rootAPmac argument leads to command injection. The attack can be executed remotely and the exploit is public.
Original NVD description (English source)
A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. Such manipulation of the argument ShareName/SelectName leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.