CVE-2026-9481: Edimax EW-7438RPn formStats stack-based overflow
A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of the argument submit-url causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Edimax EW-7438RPn 1.31from your environment.Remove or disconnect the affected device from the network until the vendor provides a patch or an official mitigation.
- Configuration
Disable remote administration/web management on the device to prevent remote exploitation.
Edimax EW-7438RPn remote management / web admin interface = disabled - Compensating control
Block or restrict network access to the device management interfaces and specifically to the endpoint /goform/formStats (for example, firewall or WAF rules to deny requests to /goform/formStats or allow access only from trusted IP addresses).
- Operational
Monitor network and device logs for requests to /goform/formStats and other indicators of exploitation; isolate, investigate and remediate any devices showing signs of compromise and replace devices if necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9481?
CVE-2026-9481 has a severity rating of high, with a CVSS score of 8.8.
How can I fix CVE-2026-9481?
To fix CVE-2026-9481, it is recommended to update the firmware of the Edimax EW-7438RPn device to the latest version provided by the vendor.
What type of vulnerability is CVE-2026-9481?
CVE-2026-9481 is a stack-based buffer overflow vulnerability.
Can CVE-2026-9481 be exploited remotely?
Yes, CVE-2026-9481 can be exploited remotely, allowing attackers to manipulate the `submit-url` argument.
Which product is affected by CVE-2026-9481?
CVE-2026-9481 affects the Edimax EW-7438RPn model running firmware version 1.31.