CVE-2026-19961 in EW-7478APC
Summary
by MITRE • 08/17/2026
A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/23/2026
The Edimax EW-7478APC wireless access point, specifically running firmware version 1.04, contains a critical remote code execution vulnerability rooted in improper input validation within its web management interface. The flaw resides in the formWlSiteSurvey function located in the /goform/formWlSiteSurvey script, which is responsible for handling site survey requests from administrators or potentially malicious actors interacting with the device's configuration portal. This component processes user-supplied data to determine wireless network parameters and scan results, but fails to adequately sanitize or bound the input provided via the selSSID argument.
The technical nature of this vulnerability is a classic buffer overflow condition caused by insufficient bounds checking when processing the selSSID parameter. When an attacker submits a specially crafted string that exceeds the expected length for this variable, it overwrites adjacent memory locations on the stack or heap. This memory corruption allows for arbitrary code execution with the privileges of the vulnerable process, which typically runs as root in embedded Linux-based devices like access points. The vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input and aligns with ATT&CK technique T1190: Exploit Public-Facing Application, as it targets a service exposed to external networks.
Because the vulnerable function is accessible through the web interface, which is often configured for remote management in enterprise or home office environments, the attack vector is fully remote. An unauthenticated attacker can exploit this flaw over standard HTTP or HTTPS protocols without needing prior access credentials if the administrative interface is not properly secured with strong authentication and network segmentation. The availability of public exploits significantly lowers the barrier to entry for attackers, enabling widespread automated attacks against vulnerable devices on the internet. Successful exploitation grants full control over the device, allowing the attacker to pivot into internal networks, intercept traffic, or use the compromised access point as a botnet node.
The operational impact is severe, compromising the confidentiality, integrity, and availability of both the network infrastructure and connected clients. Beyond direct compromise of the router, this vulnerability can facilitate lateral movement within local area networks, DNS spoofing attacks, and man-in-the-middle scenarios where sensitive data such as login credentials or financial information could be intercepted. Given that Edimax did not respond to disclosure attempts, there is no official patch available for firmware version 1.04, leaving users with limited remediation options other than upgrading to a newer, patched model if supported by the vendor in later releases.
Mitigation strategies must focus on network-level controls and configuration hardening since software patches are unavailable for this specific legacy firmware. Administrators should disable remote management features entirely, ensuring that the web interface is only accessible from trusted internal subnets behind robust firewalls. If remote access is strictly required, it should be restricted to specific IP addresses using ACLs and protected by strong, complex passwords alongside multi-factor authentication if supported. Additionally, deploying intrusion detection systems capable of detecting buffer overflow patterns or anomalous HTTP requests targeting the /goform/ endpoints can provide an additional layer of defense. Organizations relying on this hardware should prioritize replacement with modern devices that receive regular security updates to eliminate exposure to known public exploits.