Description
A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-16
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow exists in the formWanTcpipSetup function of Edimax EW‑7478APC firmware 1.04. By supplying a specially crafted pppUserName string via the /goform/formWanTcpipSetup endpoint, an attacker can overflow the stack, potentially leading to arbitrary code execution. The vulnerability is publicly documented and the exploit code has been made available, meaning remote attackers can drive the exploit by sending crafted HTTP requests without needing local access.

Affected Systems

The affected product is the Edimax EW‑7478APC wireless access point, firmware version 1.04. No other versions are listed in the CNA data, so only this firmware revision is confirmed to be vulnerable.

Risk and Exploitability

The CVSS score of 9.4 categorises this flaw as Critical, giving it a high impact and high exploitability. EPSS data is not available, but the existence of public exploit code combined with the absence of a vendor patch indicates that the probability of exploitation in the wild is significant. The vulnerability is not yet catalogued in CISA KEV, but that does not diminish its risk. Based on the description, it is inferred that attackers can reach the device through the WAN interface, craft requests to the vulnerable endpoint, and trigger the stack overflow to compromise the device remotely.

Generated by OpenCVE AI on August 16, 2026 at 23:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Identify if the device is running firmware 1.04 and replace it with a newer, non‑vulnerable firmware once it becomes available.
  • If no patch exists, block remote management access to the router by disabling WAN‑side configuration or by restricting the /goform interface to trusted IPs.
  • Isolate the device from untrusted networks or place it in a separate, monitored network segment to limit potential damage.

Generated by OpenCVE AI on August 16, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Edimax EW-7478APC formWanTcpipSetup stack-based overflow
First Time appeared Edimax
Edimax ew-7478apc
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:*
Vendors & Products Edimax
Edimax ew-7478apc
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Edimax Ew-7478apc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-16T22:30:15.064Z

Reserved: 2026-08-16T07:07:38.069Z

Link: CVE-2026-19959

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T23:16:24.710

Modified: 2026-08-16T23:16:24.710

Link: CVE-2026-19959

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-16T23:30:12Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow