CVE-2026-13562: Edimax EW-7478APC Buffer Overflow Remote Code Execution

Technical summary

CVE-2026-13562 is a stack-based or heap-based buffer overflow in the formiNICSiteSurvey POST request handler of the Edimax EW-7478APC firmware 1.04. The vulnerability exists in the selSSID parameter processing, which fails to implement proper input bounds checking. This allows an authenticated remote attacker to overwrite memory, leading to code execution. The flaw is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), indicating a classic unsafe buffer operation. The attack vector is network-accessible, requires valid credentials, and can be executed without user interaction.

Business impact

A compromised Edimax wireless extender can serve as a persistent foothold in a corporate or home network. An attacker gaining code execution could monitor encrypted traffic at the network layer, inject malicious traffic, or use the device as a pivot point to access internal systems. For organizations relying on Edimax extenders for coverage in secure environments—including remote offices or guest networks—this represents a significant integrity and confidentiality risk. The lack of vendor response compounds the issue, as customers cannot rely on timely patches.

Affected systems

Edimax EW-7478APC firmware version 1.04 is confirmed vulnerable. The specific scope of affected revisions or hardware variants is not documented in the source disclosure. Organizations using this model should assume version 1.04 is at risk and verify the firmware version running on deployed devices. Contact Edimax support or consult the device management interface to confirm firmware versions across your environment.

Exploitability

This vulnerability requires authentication, which reduces opportunistic exploitation on internet-facing devices. However, the requirement is modest: valid credentials (which may be default or weak on many unmanaged devices) and network access to the device's web management interface. Public exploit code has been published, removing the barrier to practical weaponization. The attack vector is straightforward, requires no user interaction, and likelihood of successful exploitation is high once access is obtained. Organizations with lax credential management or devices exposed to untrusted networks face elevated risk.

Remediation

Edimax has not released a patch as of the vulnerability publication date and has not responded to vendor outreach. Organizations must prioritize network segmentation and access controls: restrict management access to the EW-7478APC to trusted network segments, disable remote management features if not required, and rotate default credentials immediately. Monitor network traffic from the device for anomalies. Organizations unable to implement compensating controls should consider replacement with actively maintained hardware from a vendor with demonstrated patch responsiveness.

Patch guidance

No official patch has been issued by Edimax. Monitor the vendor's security advisories and firmware release page regularly for updates to firmware version 1.04. If you are running this firmware, verify the device model and consider contacting Edimax support directly to inquire about availability timelines. In the interim, focus on network isolation: ensure the device is not accessible from the internet, restrict web interface access to a management VLAN, and implement authentication and authorization controls at the network perimeter.

Detection guidance

Monitor for POST requests to /goform/formiNICSiteSurvey on Edimax devices, particularly those containing suspicious selSSID parameter values (unusually long strings, non-printable characters, or encoding anomalies). Implement network segmentation to reduce the number of systems that can reach the device's management interface. Review device access logs for authentication attempts and configuration changes. Intrusion detection systems can be configured to flag requests matching known exploit patterns, though signature-based detection should be combined with behavioral monitoring for modified or zero-day variants.

Why prioritize this

Despite requiring authentication, this vulnerability scores HIGH (8.8 CVSS) due to its impact: code execution with full privileges on a network appliance. The publication of working exploit code and vendor non-response eliminate the window for coordinated disclosure tactics. Devices in production networks should be addressed within weeks, not months. Priority should be highest for devices in security-sensitive network segments (guest networks, DMZs, remote office interconnects) and those with default or weak credentials.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) network-accessible attack vector; (2) low complexity with no user interaction; (3) authentication requirement that moderately limits scope; and (4) high impact across confidentiality, integrity, and availability. The score does not account for exploit availability or lack of vendor support, which in practice amplify risk. This is a legitimate HIGH-severity finding suitable for immediate remediation planning.

Frequently asked questions