CVE-2026-9348
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in Edimax EW-7438RPn up to version 1.31 in the /goform/mp file. The attack can be launched remotely and the exploit is public.
Risk Assessment
Stack-based buffer overflow could allow remote code execution, leading to full device compromise and network takeover.
Recommendation
Disable remote access to the admin panel immediately and contact the vendor for patches.
Other vulnerabilities in Edimax EW-7438RPn
See all- CVE-2026-9482High
Stack-based buffer overflow vulnerability in the formSDHCP function in /goform/formSDHCP on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9481High
Stack-based buffer overflow vulnerability in the formStats function in /goform/formStats on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9480High
A vulnerability was detected in Edimax EW-7438RPn 1.31. The function formrefresh in the file /goform/formrefresh is vulnerable to stack-based buffer overflow via the submit-url argument. The attack can be launched remotely, and the exploit is public. The vendor did not respond.
- CVE-2026-9479High
Stack-based buffer overflow vulnerability in the formLogout function in /goform/formLogout on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9463High
Stack-based buffer overflow vulnerability in the formLicence function in /goform/formLicence on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9462High
Stack-based buffer overflow vulnerability in the formWpsProxyEnable function in /goform/formWpsProxyEnable on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9461High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formRadius function of the /goform/formRadius file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9460High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formAccept function of the /goform/formAccept file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9459High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formConnectionSetting function of the /goform/formConnectionSetting file via manipulation of the max_Conn/timeOut arguments. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9427High
Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formWlSiteSurvey function of the /goform/formWlSiteSurvey file in the webs component. Manipulation of the selSSID/submit-url arguments causes the overflow. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was found in Edimax EW-7438RPn up to 1.31. Affected by this vulnerability is an unknown functionality of the file /goform/mp of the component webs. The manipulation of the argument webs results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.