CVE-2026-9344: Edimax EW-7438RPn webs formWpsStart stack-based overflow
A security vulnerability has been detected in Edimax EW-7438RPn up to 1.31. The impacted element is an unknown function of the file /goform/formWpsStart of the component webs. Such manipulation of the argument pinCode/wlan-url leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable WPS (Wi‑Fi Protected Setup) or disable the web WPS start functionality to prevent exploitation of the /goform/formWpsStart endpoint that processes pinCode/wlan-url.
Edimax EW-7438RPn (webs / /goform/formWpsStart) WPS (formWpsStart) = disabled - Configuration
Disable remote web management from WAN or restrict web management access to LAN or a limited set of trusted IP addresses to prevent remote exploitation.
Edimax EW-7438RPn (web management) remote_management = disabled or restricted - Compensating control
At the network perimeter or on internal firewalls/ACLs, block or restrict access to the device's HTTP/HTTPS management ports and WPS-related endpoints (including /goform/formWpsStart) from untrusted networks; allow only trusted management IPs.
- Compensating control
Isolate affected devices (place on a management VLAN or remove from general network access) until a vendor-supplied firmware fix or other mitigation is applied.
- Operational
Monitor logs and network traffic for requests to /goform/formWpsStart or other suspicious WPS activity and investigate indicators of exploitation; preserve logs/evidence for forensic analysis if compromise is suspected.
- Operational
Watch vendor advisories for firmware updates or patches and apply vendor-supplied fixes when available; if the vendor remains unresponsive, consider replacing the device with a supported model.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9344?
CVE-2026-9344 has a high severity rating of 8.8.
How do I fix CVE-2026-9344?
To fix CVE-2026-9344, update the Edimax EW-7438RPn device to version 1.31 or later.
What type of vulnerability is CVE-2026-9344?
CVE-2026-9344 is classified as a stack-based buffer overflow vulnerability.
Can CVE-2026-9344 be exploited remotely?
Yes, CVE-2026-9344 can be exploited remotely through manipulation of specific arguments.
Which component of Edimax EW-7438RPn is affected by CVE-2026-9344?
CVE-2026-9344 affects the /goform/formWpsStart function within the webs component.