CVE-2026-19959
CriticalCVSS 9.9Summary
A weakness was identified in Edimax EW-7478APC 1.04. It affects the formWanTcpipSetup function in /goform/formWanTcpipSetup. Manipulating the pppUserName argument causes a stack-based buffer overflow. Remote exploitation is possible and the exploit is public.
Risk Assessment
Potential for remote code execution or device crash. Public exploit increases attack risk.
Recommendation
Update the device firmware if a patch is available. Restrict administrative access.
Original NVD description (English source)
A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.