CVE-2026-9479: Edimax EW-7438RPn formLogout stack-based overflow
A security vulnerability has been detected in Edimax EW-7438RPn 1.31. The affected element is the function formLogout of the file /goform/formLogout. The manipulation of the argument submit-url leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax EW-7438RPn 1.31from your environment.Remove or isolate the affected device from the production network until a vendor patch or mitigation is available. Replace the device with non-affected hardware if continuous use is required.
- Configuration
Disable remote/WAN access to the device's web management interface and administration over HTTP/HTTPS. If possible, restrict management access to a specific trusted LAN IP range or to a dedicated management VLAN.
Edimax EW-7438RPn web management interface (firmware 1.31) remote_management = disabled - Compensating control
At the network perimeter or host firewall, block or filter HTTP(S) requests to the device management endpoints (for example paths under /goform/) and restrict access to the device's management ports to trusted IPs only.
- Operational
Monitor logs for exploitation attempts targeting /goform/formLogout and related anomalies. If compromise is suspected, isolate the device, perform incident response (including factory reset where appropriate), and rotate any credentials that may have been used to access the device.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9479?
The severity of CVE-2026-9479 is high with a CVSS score of 8.8.
How do I fix CVE-2026-9479?
To fix CVE-2026-9479, it is recommended to update the Edimax EW-7438RPn firmware to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-9479?
CVE-2026-9479 is classified as a stack-based buffer overflow vulnerability.
Can CVE-2026-9479 be exploited remotely?
Yes, CVE-2026-9479 can be exploited remotely, which increases its risk level.
What component of Edimax EW-7438RPn is affected by CVE-2026-9479?
The affected component is the function formLogout located in the file /goform/formLogout.