Executive brief
A vulnerability exists in the Edimax EW-7438RPn Wi-Fi extender that could allow an attacker to take control of the device. By sending a specially crafted web request, an attacker can cause the device to crash or potentially execute malicious code. This could lead to a complete loss of network connectivity through the extender or unauthorized access to the local network.
Technical details
A stack-based buffer overflow vulnerability exists in the 'webs' binary of the Edimax EW-7438RPn extender (firmware 1.31). The issue resides in the 'mp' function, where the 'command' POST parameter is copied into a local stack variable without adequate bounds checking. An attacker with network access and low-level authentication can exploit this by sending an overly long string in the 'command' argument to the /goform/mp endpoint. Successful exploitation can lead to a denial of service (device crash) or arbitrary code execution by overwriting the function's return address. A public exploit (PoC) is available, and the vendor has reportedly not responded to disclosure attempts.
Affected products
- Edimax EW-7438RPn 1.31
Timeline
- 2026-05-24: advisory: Initial disclosure by VulDB and NVD
- 2026-05-24: disclosed: Public PoC released on GitHub