CVE-2026-9344
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was detected in Edimax EW-7438RPn up to version 1.31 in the formWpsStart function of /goform/formWpsStart. The attack can be launched remotely and the exploit is public.
Risk Assessment
Stack-based buffer overflow could allow remote code execution, leading to full device compromise and network takeover.
Recommendation
Disable remote access to the admin panel immediately and contact the vendor for patches.
Other vulnerabilities in Edimax EW-7438RPn
See all- CVE-2026-9482High
Stack-based buffer overflow vulnerability in the formSDHCP function in /goform/formSDHCP on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9481High
Stack-based buffer overflow vulnerability in the formStats function in /goform/formStats on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9480High
A vulnerability was detected in Edimax EW-7438RPn 1.31. The function formrefresh in the file /goform/formrefresh is vulnerable to stack-based buffer overflow via the submit-url argument. The attack can be launched remotely, and the exploit is public. The vendor did not respond.
- CVE-2026-9479High
Stack-based buffer overflow vulnerability in the formLogout function in /goform/formLogout on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9463High
Stack-based buffer overflow vulnerability in the formLicence function in /goform/formLicence on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9462High
Stack-based buffer overflow vulnerability in the formWpsProxyEnable function in /goform/formWpsProxyEnable on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9461High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formRadius function of the /goform/formRadius file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9460High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formAccept function of the /goform/formAccept file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9459High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formConnectionSetting function of the /goform/formConnectionSetting file via manipulation of the max_Conn/timeOut arguments. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9427High
Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formWlSiteSurvey function of the /goform/formWlSiteSurvey file in the webs component. Manipulation of the selSSID/submit-url arguments causes the overflow. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the component webs. Such manipulation of the argument pinCode/wlan-url leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.