CVE-2026-9343: Edimax EW-7438RPn webs formWpsStart os command injection
A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable WPS and any WPS PIN functionality on the device to prevent use of the vulnerable formWpsStart endpoint.
Edimax EW-7438RPn WPS (formWpsStart / WPS PIN) = disabled - Compensating control
Block access to the device web management interface from untrusted networks (e.g., block WAN access, restrict management ports to trusted IPs via firewall/ACL).
- Compensating control
Place the device on an isolated network segment or VLAN with no direct Internet access and restrict inter-segment routing to only required hosts.
- Operational
If possible, remove affected devices from production networks (disconnect power or network) until a vendor fix is available or other mitigations are in place.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9343?
The severity of CVE-2026-9343 is medium with a score of 6.3.
What type of vulnerability is CVE-2026-9343?
CVE-2026-9343 is classified as an OS command injection vulnerability.
How do I fix CVE-2026-9343?
To fix CVE-2026-9343, update the Edimax EW-7438RPn device to the latest firmware version that addresses this security issue.
Can CVE-2026-9343 be exploited remotely?
Yes, CVE-2026-9343 allows for remote exploitation due to the nature of the command injection.
Which component of the Edimax EW-7438RPn is affected by CVE-2026-9343?
The affected component in CVE-2026-9343 is the webs function formWpsStart.