CVE-2026-9346: Edimax EW-7438RPn webs formWirelessTbl buffer overflow
A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax EW-7438RPnfrom your environment.Disconnect or remove the affected device from networks (or replace it) until a vendor-supplied firmware fix is available.
- Configuration
Disable the device's web management interface (the 'webs' service) or configure it to LAN-only to prevent remote access to the vulnerable formWirelessTbl endpoint.
webs (Edimax EW-7438RPn) remote_web_management = disabled - Compensating control
Block access to the device's web management ports from untrusted networks (e.g., block WAN/Internet access and restrict to trusted IPs via firewall/ACL). Devices running firmware up to 1.31 are vulnerable and should not be reachable from the Internet.
- Operational
Monitor device and network logs for indicators of exploitation targeting the /goform/formWirelessTbl endpoint and apply vendor firmware updates as soon as they are released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9346?
The severity of CVE-2026-9346 is high, with a CVSS score of 8.8.
How do I fix CVE-2026-9346?
To fix CVE-2026-9346, update your Edimax EW-7438RPn to the latest firmware version.
What is the impact of CVE-2026-9346?
CVE-2026-9346 can lead to a remote buffer overflow vulnerability affecting the wireless settings of the device.
Who is affected by CVE-2026-9346?
CVE-2026-9346 affects users of the Edimax EW-7438RPn with firmware version 1.31 or earlier.
What kind of attack can exploit CVE-2026-9346?
An attacker can exploit CVE-2026-9346 by manipulating the submit-url argument, potentially leading to a buffer overflow.