{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ew-7478apc-1.04/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-19959"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EW-7478APC (1.04)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","buffer-overflow","router","cve-2026-19961","vulnerability","network-device","cve"],"_cs_type":"advisory","_cs_vendors":["Edimax"],"content_html":"\u003cp\u003eA stack-based buffer overflow vulnerability has been identified in the Edimax EW-7478APC router, specifically within firmware version 1.04. The vulnerability resides in the formWanTcpipSetup function, accessible via the /goform/formWanTcpipSetup endpoint. An authenticated remote attacker can trigger this overflow by sending a specially crafted input to the pppUserName parameter. This flaw allows for the execution of arbitrary code on the affected device or can result in a denial-of-service condition. Publicly available exploit code exists, increasing the risk of exploitation. The vendor has not provided a patch or response to the disclosure. Defenders should note that this vulnerability requires authenticated access, but its remote nature and the availability of exploit material pose a significant risk to internal network segments where these devices are deployed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs network reconnaissance to identify reachable Edimax EW-7478APC management interfaces.\u003c/li\u003e\n\u003cli\u003eAttacker obtains valid administrative or user credentials via secondary means (e.g., credential stuffing or default password exploitation).\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the web-based management interface.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP POST request targeting the /goform/formWanTcpipSetup endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects a long string payload into the pppUserName parameter of the POST body.\u003c/li\u003e\n\u003cli\u003eThe web server process fails to perform sufficient boundary checks on the pppUserName input before copying it into a stack-based buffer.\u003c/li\u003e\n\u003cli\u003eThe overflow overwrites the return address, enabling redirection of execution flow to arbitrary attacker-supplied shellcode.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved: arbitrary command execution or system crash.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for complete compromise of the router, potentially providing an attacker with a pivot point into the local network. With a CVSS v3.1 score of 9.9, this vulnerability represents a critical risk to small office and home office (SOHO) deployments. If exploited, attackers could intercept traffic, perform man-in-the-middle attacks, or deploy further malicious payloads. Given the lack of a vendor patch, the only effective mitigation is to restrict management interface access to trusted networks or replace affected hardware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to the management web interface of all Edimax EW-7478APC devices to a dedicated management VLAN or trusted IP addresses via firewall rules.\u003c/li\u003e\n\u003cli\u003eMonitor internal network traffic for unauthorized HTTP POST requests directed at /goform/formWanTcpipSetup.\u003c/li\u003e\n\u003cli\u003eAudit logs for failed authentication attempts preceding any interaction with management endpoints.\u003c/li\u003e\n\u003cli\u003eIsolate affected devices from the internet until a firmware update is provided by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T00:42:49Z","date_published":"2026-08-17T00:42:27Z","id":"https://feed.craftedsignal.io/briefs/2026-08-edimax-buffer-overflow/","summary":"Edimax EW-7478APC version 1.04 is vulnerable to a stack-based buffer overflow in the formWanTcpipSetup function, allowing for remote code execution via the pppUserName parameter.","title":"Stack-based Buffer Overflow in Edimax EW-7478APC","url":"https://feed.craftedsignal.io/briefs/2026-08-edimax-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - EW-7478APC (1.04)","version":"https://jsonfeed.org/version/1.1"}