CVE-2026-9480: Edimax EW-7438RPn formrefresh stack-based overflow
A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of the argument submit-url results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable remote/web management access (HTTP/HTTPS) to the device or restrict it to trusted LAN IPs only until a vendor fix is available.
Edimax EW-7438RPn web management remote_management = disabled - Compensating control
Block WAN/internet access to the device's management ports and restrict access to the management interface to trusted IP addresses at the network firewall or router.
- Compensating control
Deploy WAF/firewall rules to block or inspect requests to the URI /goform/formrefresh and to drop requests with suspicious or overly long submit-url parameter values to prevent exploitation of the buffer overflow.
- Operational
Monitor logs and network traffic for requests to /goform/formrefresh and indicators of exploitation (including abnormal submit-url values). If exploitation is suspected, isolate the device from the network and perform device recovery (e.g., factory reset or replacement) and investigation.
- Operational
Apply any vendor-supplied security update or patch for the Edimax EW-7438RPn as soon as it becomes available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9480?
CVE-2026-9480 has a high severity rating of 8.8.
How do I fix CVE-2026-9480?
To fix CVE-2026-9480, apply the latest firmware update provided by Edimax for the EW-7438RPn.
What impact does CVE-2026-9480 have?
CVE-2026-9480 allows remote attackers to execute arbitrary code due to a stack-based buffer overflow.
What software is affected by CVE-2026-9480?
CVE-2026-9480 affects the Edimax EW-7438RPn version 1.31.
Can CVE-2026-9480 be exploited remotely?
Yes, CVE-2026-9480 can be exploited remotely by manipulating the submit-url argument.