CVE-2026-9426: Edimax EW-7438RPn formHwSet stack-based overflow
A vulnerability was detected in Edimax EW-7438RPn 1.31. This affects the function formHwSet of the file /goform/formHwSet. The manipulation of the argument Anntena/Mcs/regDomain/nic0Addr/nic1Addr/wlanAddr/wanAddr/wlanSSID/wlanChan/initgain/txcck/txofdm/submit-url results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax EW-7438RPn 1.31from your environment.If the device cannot be effectively protected, disconnect it from production networks or replace it with a non-affected device until a vendor fix is available.
- Configuration
Disable remote/web administrative access (especially WAN-side access) on the device to prevent remote exploitation of the /goform/formHwSet endpoint.
Edimax EW-7438RPn web administration remote_management = disabled - Compensating control
Block access to the /goform/formHwSet path and block HTTP/HTTPS management access to the device from untrusted networks at perimeter and internal firewalls or WAFs. Restrict administrative access to trusted management IPs only.
- Operational
Monitor logs for requests to /goform/formHwSet and other suspicious activity, isolate any devices showing signs of compromise, and apply vendor firmware updates as soon as a patch or advisory is published.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9426?
CVE-2026-9426 has a severity rating of high, with a CVSS score of 8.8.
How do I fix CVE-2026-9426?
To mitigate CVE-2026-9426, update the Edimax EW-7438RPn firmware to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-9426?
CVE-2026-9426 is a stack-based buffer overflow vulnerability.
What devices are affected by CVE-2026-9426?
CVE-2026-9426 affects the Edimax EW-7438RPn model running firmware version 1.31.
What are the potential consequences of exploiting CVE-2026-9426?
Exploiting CVE-2026-9426 could allow an attacker to execute arbitrary code on the affected device.