The vulnerability exposes a stack‑based buffer overflow in the formAccept function of the/router’s web interface. By carefully crafting the submit-url argument, an attacker can overflow the stack and potentially execute arbitrary code, effectively bypassing the router’s security controls. This flaw aligns with CWE‑119 and CWE‑121, indicating that unvalidated input leads to an uncontrolled buffer overrun.

The flaw has been identified in the Edimax EW‑7438RPn router running firmware version 1.31. No other versions or editions were disclosed in the current data.

The CVSS score of 8.7 denotes a high‑severity vulnerability that can be triggered remotely without authentication. EPSS is not available, yet the existence of a publicly released exploit indicates a non‑negligible exploitation probability. It is not currently listed in the CISA KEV catalog. The likely attack vector is an unauthenticated remote attack via the device’s web interface, specifically the /goform/formAccept endpoint. Successful exploitation could grant full control over the device, allowing an adversary to compromise network traffic, inject malware, or pivot to other systems on the LAN.