The vulnerability resides in the formQoS POST request handler of the Edimax EW-7478APC router, specifically the argument selSSID. Malicious manipulation of this argument triggers a buffer overflow (CWE-119 and CWE-120). The overflow can compromise the device’s execution context, potentially leading to arbitrary code execution or denial of service. The impact extends to confidentiality, integrity, and availability of the affected router and any networks it protects.

The affected product is the Edimax EW-7478APC 1.04 router. No other versions are specifically mentioned, so only 1.04 is confirmed to be vulnerable. The sink is the /goform/formQoS endpoint exposed via HTTP POST.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is unavailable, but the exploit has been publicly disclosed, suggesting that adversaries could employ it. No KEV listing currently exists, yet the remote nature of the attack implies that access to the router’s web interface is sufficient for exploitation, likely without authentication. If no mitigation is applied, the attacker could gain full control of the device.