Description

A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-16T23:16:24.710Z",
  "pubdate": "2026-08-16T23:16:24.710Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Edimax EW-7478APC router running firmware version 1.04. The flaw resides within the formWanTcpipSetup function located in the /goform/formWanTcpipSetup endpoint, specifically triggered via improper validation of the pppUserName argument. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service condition by sending a specially crafted HTTP request containing an overly long payload. The risk is heightened by the public availability of exploit code and the lack of a vendor patch, as the manufacturer failed to respond to early disclosure notifications. Successful exploitation compromises the confidentiality, integrity, and availability of the affected device, potentially granting the attacker complete control over the networking hardware from a remote network location without requiring prior authentication.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from unsafe memory handling within the router's web management interface. The vulnerable component is the binary handling requests for the /goform/formWanTcpipSetup URI, specifically targeting the formWanTcpipSetup function. During the processing of HTTP POST or GET parameters, the application extracts the value associated with the pppUserName argument. The root cause of the vulnerability is the absence of adequate boundary checks or length validation on the input buffer before copying the string into a fixed-size stack allocation.\nExploitation of this vulnerability is achievable remotely over the network. An attacker can craft a malicious HTTP request where the pppUserName parameter exceeds the allocated buffer size. When the formWanTcpipSetup function processes this input, the excessive data overflows the stack frame, overwriting adjacent memory structures, including saved frame pointers and return addresses. By carefully structuring the payload, an attacker can hijack the execution flow of the binary, redirecting processor instructions to shellcode included within the payload or leveraging Return-Oriented Programming (ROP) chains if platform mitigations such as DEP/NX are present.\nThe attack flow proceeds as follows: First, the attacker identifies the target Edimax EW-7478APC device exposed to the network, typically via the WAN or LAN interface depending on remote management configurations. Second, the attacker formulates an HTTP request targeting /goform/formWanTcpipSetup, injecting a malicious payload designed to overflow the input buffer into the pppUserName field. Third, upon receipt and parsing of the request, the underlying firmware executes the vulnerable function, triggering the memory corruption. Finally, the overwritten return address causes the program to crash or execute the injected instructions with the privileges of the http daemon or root, leading to total compromise of the embedded Linux operating system running on the router."
}