CVE-2026-9360
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A buffer overflow vulnerability was discovered in Edimax EW-7438RPn version 1.28a in the formwlencrypt24g function of /goform/formwlencrypt24g. The attack can be launched remotely and the exploit is public.
Risk Assessment
Buffer overflow could allow remote code execution, leading to full device compromise and network infiltration.
Recommendation
Disable remote access to the admin panel immediately and contact the vendor for patches.
Other vulnerabilities in Edimax EW-7438RPn
See all- CVE-2026-9482High
Stack-based buffer overflow vulnerability in the formSDHCP function in /goform/formSDHCP on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9481High
Stack-based buffer overflow vulnerability in the formStats function in /goform/formStats on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9480High
A vulnerability was detected in Edimax EW-7438RPn 1.31. The function formrefresh in the file /goform/formrefresh is vulnerable to stack-based buffer overflow via the submit-url argument. The attack can be launched remotely, and the exploit is public. The vendor did not respond.
- CVE-2026-9479High
Stack-based buffer overflow vulnerability in the formLogout function in /goform/formLogout on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9463High
Stack-based buffer overflow vulnerability in the formLicence function in /goform/formLicence on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9462High
Stack-based buffer overflow vulnerability in the formWpsProxyEnable function in /goform/formWpsProxyEnable on Edimax EW-7438RPn 1.31. Manipulating the submit-url argument can lead to buffer overflow.
- CVE-2026-9461High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formRadius function of the /goform/formRadius file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9460High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formAccept function of the /goform/formAccept file via manipulation of the submit-url argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9459High
A stack-based buffer overflow vulnerability was found in the Edimax EW-7438RPn 1.31 in the formConnectionSetting function of the /goform/formConnectionSetting file via manipulation of the max_Conn/timeOut arguments. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-9427High
Edimax EW-7438RPn version 1.31 is vulnerable to a stack-based buffer overflow in the formWlSiteSurvey function of the /goform/formWlSiteSurvey file in the webs component. Manipulation of the selSSID/submit-url arguments causes the overflow. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.