Description
A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-05-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow exists in the formwlencrypt24g POST request handler of Edimax EW-7438RPn firmware 1.28a. The vulnerability arises when an attacker supplies a specially crafted key1 value, allowing them to overwrite memory and potentially execute arbitrary code. The flaw is classified as a buffer overflow (CWE-119) and corresponds to an overflow of a buffer (CWE-120), which can compromise confidentiality, integrity, and availability of the device.

Affected Systems

Edimax EW-7438RPn wireless routers running firmware version 1.28a are affected. The flaw is located in the HTTP POST endpoint /goform/formwlencrypt24g within the POST Request Handler component. No other firmware versions are listed as affected.

Risk and Exploitability

The CVSS base score of 8.7 indicates high severity, and the attack can be performed remotely over the network. Publicly available exploits have been released, and the vulnerability is not yet tracked in the CISA KEV list. With no vendor patch currently available, the risk remains high. An attacker can trigger the overflow by sending a crafted HTTP POST request to the vulnerable endpoint, potentially gaining arbitrary code execution on the device.

Generated by OpenCVE AI on May 24, 2026 at 08:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update for the Edimax EW-7438RPn when made available
  • Restrict external access to the device by placing it behind a firewall that blocks unsolicited incoming traffic
  • Block or disable the /goform/formwlencrypt24g POST endpoint through device configuration or network filtering

Generated by OpenCVE AI on May 24, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 24 May 2026 07:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Edimax EW-7438RPn 1.28a. Affected by this issue is the function formwlencrypt24g of the file /goform/formwlencrypt24g of the component POST Request Handler. The manipulation of the argument key1 results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Edimax EW-7438RPn POST Request formwlencrypt24g buffer overflow
First Time appeared Edimax
Edimax ew-7438rpn
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:*
Vendors & Products Edimax
Edimax ew-7438rpn
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Edimax Ew-7438rpn
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-24T06:15:08.997Z

Reserved: 2026-05-23T09:58:10.907Z

Link: CVE-2026-9360

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-24T09:15:40Z

Weaknesses