Executive brief
The Edimax EW-7438RPn, a Wi-Fi extender used to increase wireless coverage, contains a security flaw in its web management interface. An attacker can send specially crafted network requests to the device to cause it to crash or potentially take full control of the hardware. This could lead to a complete loss of internet connectivity for connected users or unauthorized access to the local network.
Technical details
A stack-based buffer overflow exists in the 'webs' binary of Edimax EW-7438RPn firmware version 1.31. The vulnerability is located within the 'formWlanMP' function in the '/goform/formWlanMP' file. The root cause is a failure to validate the length of several POST parameters, including 'ateFunc', 'ateGain', and 'ateTxCount', before copying them into fixed-size stack buffers. An attacker with network access and basic authentication can exploit this by sending an overly long string in these parameters to overwrite the return address on the stack. This can lead to remote code execution (RCE) or a persistent denial of service (DoS) by crashing the device's web server. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- Edimax EW-7438RPn 1.31
Timeline
- 2026-05-25: disclosed: Public disclosure of the vulnerability and PoC
- 2026-05-25: advisory: CVE-2026-9425 published by NVD/VulDB