PatchSiren cyber security CVE debrief
CVE-2026-9347 Edimax CVE debrief
A command injection vulnerability exists in the Edimax EW-7438RPn wireless range extender, affecting firmware versions up to 1.31. The vulnerability resides in the `formWizSurvey` function within the `/goform/formWizSurvey` endpoint of the device's web server (`webs`). The `ip`, `mask`, and `gateway` parameters are not properly sanitized, allowing an authenticated attacker to inject arbitrary operating system commands. The attack vector is network-based and requires low privileges (authenticated access). The vulnerability was disclosed publicly on 2026-05-24 after the vendor was contacted but did not respond. The CVSS 4.0 score of 2.1 reflects limited impacts to confidentiality, integrity, and availability given the authentication requirement, though the public availability of exploit details increases practical risk. The CVE record status is currently 'Deferred' in the NVD, indicating the entry may be under review or awaiting additional information.
- Vendor
- Edimax
- Product
- EW-7438RPn
- CVSS
- LOW 2.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Organizations deploying Edimax EW-7438RPn range extenders in production environments; network administrators managing SOHO or remote office infrastructure; security teams responsible for IoT device security posture; incident responders tracking exploitation of disclosed but unpatched embedded device vulnerabilities
Technical summary
The Edimax EW-7438RPn firmware through version 1.31 contains an OS command injection vulnerability in the `formWizSurvey` function of the `/goform/formWizSurvey` web endpoint. The `ip`, `mask`, and `gateway` parameters accept unsanitized input that is passed to shell execution contexts. An attacker with authenticated access can submit crafted parameter values containing shell metacharacters to execute arbitrary commands on the underlying Linux-based operating system. The vulnerability is remotely exploitable over HTTP/HTTPS. The device's `webs` server component handles the request without adequate input validation or output encoding, representing a classic injection weakness per CWE-78.
Defensive priority
medium
Recommended defensive actions
- Restrict network access to Edimax EW-7438RPn administrative interfaces to trusted management networks only
- Implement network segmentation to isolate affected range extenders from critical infrastructure
- Monitor for unauthorized access attempts to `/goform/formWizSurvey` endpoint
- Apply firmware updates from Edimax if and when available; consider replacement if vendor support is discontinued
- Review device configurations for unauthorized changes that may indicate exploitation
- resourceLinkAnnotations: [ref-4, ref-7]
Evidence notes
Vulnerability details sourced from VulDB CNA submission and NVD record. Vendor non-response documented in CVE description. CVSS 4.0 vector indicates network attack vector with low privileges required. CWE-77 and CWE-78 (command injection weaknesses) assigned by CNA. Exploit disclosure confirmed via GitHub reference.
Official resources
2026-05-24