Executive brief
A vulnerability exists in the Edimax EW-7438RPn Wi-Fi extender that could allow an attacker to take control of the device. By sending a specially crafted web request to the device's management interface, an attacker can cause the system to crash or potentially execute malicious code. This could lead to a total loss of network connectivity through the extender or unauthorized access to the local network.
Technical details
A stack-based buffer overflow vulnerability exists in the 'formWpsProxyEnable' function within the '/goform/formWpsProxyEnable' endpoint of the Edimax EW-7438RPn (firmware version 1.31). The issue stems from the 'webs' binary failing to validate the length of the 'submit-url' (and 'wlan-url') parameter before copying it into a fixed-size local stack buffer. An attacker with network access to the web management interface can exploit this by sending an oversized string in a POST request, overwriting the function's return address. This can result in a persistent denial of service (device crash) or remote code execution. Although the CVSS vector indicates low privileges are required, the exploit is public and the vendor has not responded to disclosure attempts.
Affected products
- Edimax EW-7438RPn 1.31
Timeline
- 2026-05-25: advisory: Vulnerability disclosed via VulDB and NVD
- 2026-05-25: disclosed: Public exploit code released on GitHub