The flaw resides in the formRadius function of the Edimax EW-7438RPn firmware 1.31. Malicious manipulation of the submit-url argument over the network triggers a stack-based buffer overflow. The overflow could allow an attacker to overwrite control data on the stack, resulting in arbitrary code execution on the device if an exploit payload is injected. The vulnerability is a classic out-of-bounds write, as indicated by CWE-119 and CWE-121, and poses a high-severity risk to confidentiality, integrity, and availability of the affected device.

The only product noted by the CNA is the Edimax EW-7438RPn WLAN router. The affected firmware version is 1.31. No other versions or product lines are currently listed as impacted by this vulnerability. Network-connected devices running this firmware are thus at risk if exposed to the web interface that exposes the formRadius endpoint.

The CVSS score of 8.7 classifies this issue as high severity. The EPSS score is not provided, but the vulnerability has been publicly disclosed and the vendor has not released a fix. The flaw is remotely exploitable through the formRadius endpoint, so any device with the web interface exposed to the network could be targeted. The device is not listed in the CISA KEV catalog, indicating no confirmed large-scale exploitation has been observed, but the lack of vendor response raises concern that attackers might still find or develop a PoC.