CVE-2026-9347: Edimax EW-7438RPn webs formWizSurvey os command injection
A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of the component webs. The manipulation of the argument ip/mask/gateway leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove the affected component from your environment.
If the device cannot be adequately protected by network controls or configuration changes, disconnect the Edimax EW-7438RPn device from the network or replace it to eliminate the vulnerable attack surface.
- Configuration
Disable remote web management; if remote access is required, restrict administrative access to a small set of trusted IP addresses only.
Edimax EW-7438RPn web interface (webs) remote_web_management = disabled or restricted to trusted IPs - Compensating control
Block access to the device's web management interface from untrusted networks using network ACLs/firewall rules or a WAF. Specifically block or filter requests to /goform/formWizSurvey and related management endpoints.
- Operational
Monitor device logs and network traffic for attempts to exploit /goform/formWizSurvey. If compromise is suspected, isolate the device immediately and perform remediation (e.g., factory reset or replacement).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9347?
The severity of CVE-2026-9347 is rated as medium with a score of 6.3.
How do I fix CVE-2026-9347?
To fix CVE-2026-9347, update the Edimax EW-7438RPn to the latest firmware version provided by the vendor.
What type of vulnerability is CVE-2026-9347?
CVE-2026-9347 is classified as an OS command injection vulnerability.
Can CVE-2026-9347 be exploited remotely?
Yes, CVE-2026-9347 can be exploited remotely.
Which component is affected by CVE-2026-9347?
CVE-2026-9347 affects the function formWizSurvey in the file /goform/formWizSurvey of the Edimax web component.