Description

A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-16T23:16:25.050Z",
  "pubdate": "2026-08-16T23:16:25.050Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the Edimax EW-7478APC router running firmware version 1.04. The flaw resides within the formWlSiteSurvey function exposed via the web interface at the endpoint /goform/formWlSiteSurvey. Specifically, improper handling of the selSSID HTTP parameter allows remote, unauthenticated attackers to supply input that exceeds the allocated buffer size.\nSuccessful exploitation of this vulnerability leads to memory corruption, potentially allowing arbitrary code execution or causing a denial of service (DoS) of the affected networking device. Given that the attack can be executed remotely over the network without requiring prior authentication, the risk level is high. Public exploits for this vulnerability are currently available, increasing the urgency for defensive measures.\nThe vendor was notified of this security flaw prior to public disclosure but failed to provide a response or an official firmware patch. Consequently, administrators must rely on network segmentation, access control lists, and alternative hardening mechanisms to mitigate potential exploitation attempts against vulnerable Edimax EW-7478APC units.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow stemming from inadequate bounds checking on user-supplied input. The vulnerable component is the formWlSiteSurvey function located within the web server binary processing requests for the /goform/formWlSiteSurvey URI path.\nDuring normal operation, the application parses HTTP GET or POST parameters to handle wireless site survey functionalities. The specific parameter vulnerable to manipulation is selSSID. When the binary processes an abnormally large string passed via the selSSID argument, it fails to restrict the number of bytes copied into a fixed-size stack buffer. This lack of sanitization and length validation results in a classic buffer overflow condition.\nThe attack flow begins with a remote threat actor sending a maliciously crafted HTTP request containing an oversized payload within the selSSID parameter to the /goform/formWlSiteSurvey endpoint. Because the application does not validate the input length prior to memory copy operations (such as strcpy or unsafe sprintf variants), the excess data overflows the designated stack buffer.\nThis overflow overwrites adjacent stack memory structures, which may include saved frame pointers and return addresses. By carefully structuring the payload, an attacker can hijack the execution flow of the binary, redirecting processor instructions to shellcode or executing return-oriented programming (ROP) chains.\nThe affected product is the Edimax EW-7478APC running firmware version 1.04. The vulnerability is exploitable remotely over the network, requires no authentication credentials, and can be executed by low-privileged or unauthenticated users interacting with the management web interface. Post-exploitation impact includes full system compromise, remote code execution with the privileges of the web server daemon, and persistent denial of service conditions affecting routing and wireless capabilities."
}