CVE-2026-9359: Edimax EW-7438RPn POST Request formHwSet command injection
A vulnerability was identified in Edimax EW-7438RPn 1.28a. Affected by this vulnerability is the function formHwSet of the file /goform/formHwSet of the component POST Request Handler. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/comd/initgain/txcck/txofdm leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax EW-7438RPn 1.28afrom your environment.If a vendor fix is not available, disconnect or remove the affected device from the network until a secure firmware update or replacement is provided by the vendor.
- Configuration
Disable remote/web management access to the device (prevent POST requests to /goform/formHwSet) to remove remote attack surface for the formHwSet command-injection vulnerability.
Edimax EW-7438RPn (POST handler /goform/formHwSet) remote_management_enabled = false - Compensating control
Block or restrict access to the device's management interface (HTTP POST endpoints such as /goform/formHwSet) at the network perimeter or intermediate firewalls; allow access only from trusted administrator IPs or management VLANs.
- Operational
Assume possible compromise due to publicly available exploit. Investigate device logs for signs of compromise, isolate the device from production networks, and rotate any credentials (administrative and service credentials) that the device had access to.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9359?
CVE-2026-9359 has a medium severity rating of 6.3.
How do I fix CVE-2026-9359?
To fix CVE-2026-9359, update the Edimax EW-7438RPn device firmware to the latest version provided by the manufacturer.
What type of vulnerability is CVE-2026-9359?
CVE-2026-9359 is a command injection vulnerability.
Which devices are affected by CVE-2026-9359?
The vulnerability affects the Edimax EW-7438RPn with firmware version 1.28a.
What are the potential impacts of exploiting CVE-2026-9359?
Exploitation of CVE-2026-9359 can lead to unauthorized command execution on the affected device.