PatchSiren cyber security CVE debrief
CVE-2026-9346 Edimax CVE debrief
A buffer overflow vulnerability exists in Edimax EW-7438RPn wireless range extenders running firmware up to version 1.31. The flaw resides in the `formWirelessTbl` function within the `/goform/formWirelessTbl` endpoint of the device's web server (`webs` component). Remote attackers can exploit this by manipulating the `submit-url` argument, potentially achieving code execution. The vulnerability carries a HIGH severity CVSS score of 7.4. Notably, the vendor was contacted prior to disclosure but did not respond, and exploit details have been publicly published, increasing immediate risk. The CVE was published on 2026-05-24 and last modified on 2026-05-26.
- Vendor
- Edimax
- Product
- EW-7438RPn
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Organizations deploying Edimax EW-7438RPn range extenders in production environments; network administrators managing remote or branch office infrastructure; security teams responsible for IoT device lifecycle management; incident responders tracking exploitation of published IoT vulnerabilities
Technical summary
The vulnerability is a classic buffer overflow in the `formWirelessTbl` function of the Edimax EW-7438RPn's embedded web server. The `submit-url` parameter lacks proper bounds checking, allowing remote attackers to overflow stack or heap buffers. The attack vector is network-accessible without authentication requirements (per CVSS:4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N), suggesting that while some privileges may be required (PR:L), the attack remains practical remotely. The CVSS:4.0 vector indicates high impacts across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The presence of a published exploit and vendor non-response elevates this to an active threat requiring immediate defensive action.
Defensive priority
HIGH
Recommended defensive actions
- Immediately isolate affected Edimax EW-7438RPn devices from untrusted networks or internet exposure
- Block or restrict access to the /goform/formWirelessTbl endpoint at network boundaries where possible
- Monitor for anomalous requests to device management interfaces containing oversized or malformed submit-url parameters
- Contact Edimax directly for security patch status given vendor non-response to coordinated disclosure
- Consider replacement with actively supported alternative if patches are unavailable
- Review device logs for signs of exploitation attempts prior to 2026-05-24
- Implement network segmentation to limit lateral movement if device compromise occurs
Evidence notes
Buffer overflow in formWirelessTbl function via submit-url parameter manipulation; affects firmware up to 1.31; remote attack vector confirmed; exploit publicly available per source description
Official resources
Public disclosure with published exploit; vendor non-responsive