Description
A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-16
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the formWlbasic function of the /goform/formWlbasic endpoint on the Edimax EW-7478APC Wi‑Fi access point. An attacker can supply a crafted value for the rootAPmac argument that causes the device to execute arbitrary shell commands, resulting in remote command execution. The flaw combines command injection (CWE-74) with unsafe shell usage (CWE-77).

Affected Systems

The affected product is the Edimax EW-7478APC Wi‑Fi access point, specifically firmware version 1.04. No other versions or products were mentioned in the advisory.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but exploitation is known to be possible and publicly disclosed. The attack vector is remote, likely over the network when an attacker can reach the device, and would exploit the vulnerable formWlbasic endpoint to inject commands. Because no official patch or workaround has been released, the risk remains until a firmware update that removes the flaw is applied or network controls are used to block the vulnerable endpoint.

Generated by OpenCVE AI on August 17, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest firmware release from Edimax that removes this bug, or contact the vendor for a patch if one is not yet available.
  • Block remote access to the /goform/formWlbasic endpoint using firewall or router ACLs, and limit management interfaces to trusted networks only.
  • If possible, disable or restrict the rootAPmac functionality in the device’s configuration to prevent injection payloads from being processed.
  • Monitor device logs and network traffic for unusual requests to /goform/formWlbasic and investigate any suspected injection attempts.

Generated by OpenCVE AI on August 17, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 16 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Edimax EW-7478APC formWlbasic command injection
First Time appeared Edimax
Edimax ew-7478apc
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:*
Vendors & Products Edimax
Edimax ew-7478apc
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Edimax Ew-7478apc
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-16T22:45:09.083Z

Reserved: 2026-08-16T07:07:42.117Z

Link: CVE-2026-19960

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-16T23:16:24.870

Modified: 2026-08-16T23:16:24.870

Link: CVE-2026-19960

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T00:30:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')