A stack-based buffer overflow is present in the /goform/formWpsStart handler of the Edimax EW‑7438RPn firmware when unvalidated pinCode and wlan‑url parameters are received; the flaw is recorded as CWE‑119 and CWE‑121. Manipulating these inputs can corrupt the stack and potentially allow a remote attacker to execute arbitrary code on the device.

All EW‑7438RPn units with firmware versions up to and including 1.31 are affected. The vulnerability is triggered through the web interface; based on the description, it is inferred that an attacker does not need local access to exploit it.

The flaw carries a CVSS score of 8.7, indicating high severity, and has an unknown EPSS score. It is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint over the network, likely over standard HTTP/HTTPS, and can gain full control of the device once the buffer overflow is triggered, enabling further compromise of the local network.