PatchSiren cyber security CVE debrief
CVE-2026-9348 Edimax CVE debrief
A stack-based buffer overflow vulnerability exists in Edimax EW-7438RPn wireless range extenders running firmware up to version 1.31. The vulnerability resides in the `/goform/mp` endpoint of the device's web server (`webs` component), where improper handling of the `webs` argument allows remote attackers to trigger memory corruption. The CVSS 4.0 vector indicates network attack vector with low attack complexity, low privileges required, and no user interaction needed, resulting in high impacts to confidentiality, integrity, and availability. The exploit has been publicly disclosed, and the vendor was reportedly contacted without response. The NVD entry currently shows a status of 'Deferred'.
- Vendor
- Edimax
- Product
- EW-7438RPn
- CVSS
- HIGH 7.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-24
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-24
- Advisory updated
- 2026-05-26
Who should care
Organizations deploying Edimax EW-7438RPn range extenders in production environments, particularly those with exposed management interfaces. Security teams responsible for IoT/OT device security and network segmentation. Managed service providers supporting small business networks using consumer-grade networking equipment.
Technical summary
The Edimax EW-7438RPn firmware through version 1.31 contains a stack-based buffer overflow in the `/goform/mp` handler of its embedded web server. The `webs` parameter is not properly validated, allowing remote authenticated attackers (PR:L) to overflow stack buffers and potentially execute arbitrary code. The attack is network-accessible with low complexity and no user interaction required. Public exploit availability increases immediate risk.
Defensive priority
HIGH
Recommended defensive actions
- Block or restrict access to the `/goform/mp` endpoint on affected Edimax EW-7438RPn devices at network boundaries
- Segment IoT device networks to limit lateral movement if compromise occurs
- Monitor for anomalous requests to `/goform/mp` containing oversized or malformed `webs` parameters
- Apply firmware updates from Edimax if and when released; consider device replacement given vendor non-response
- Review and disable remote administration interfaces on affected devices where not essential
Evidence notes
Vulnerability details sourced from NVD modified feed with Vuldb as CNA. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/E:P. CWE-119 and CWE-121 identified as primary weakness types. Vendor non-response documented in disclosure timeline.
Official resources
2026-05-24T04:16:53.960Z