Edimax EW-7438RPn formWlanMP stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in the formWlanMP function of the /goform/formWlanMP endpoint in the Edimax EW-7438RPn extender firmware version 1.31. The function copies user-supplied input parameters (including ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, and others) into a fixed-size stack buffer without length checking, as documented in [1]. The affected binary is webs [1]. The vulnerability is reachable by sending a crafted POST request to the /goform/formWlanMP URL.

Exploitation

An unauthenticated remote attacker can trigger the overflow by sending a POST request to the /goform/formWlanMP endpoint with one or more of the listed parameters containing an overly long string [1]. The public proof-of-concept (PoC) sets the ateFunc parameter to a long string of 'a' characters [1]. The attacker does not require any prior authentication or special network position beyond reachability of the device's web interface.

Impact

Successful exploitation overwrites the stack return address and allows arbitrary code execution at the privilege level of the webs process [1]. The attacker can potentially gain full control of the device, including modifying configuration, exfiltrating data, or using the device as a pivot point in the network. The impact is complete compromise of the affected device.

Mitigation

As of the publication date, no patch or fix has been released by Edimax; the vendor did not respond to disclosure attempts [1]. Users should consider isolating the device from untrusted networks and disabling remote management if possible. There are no known workarounds. The vendor may issue a firmware update in the future, but none is currently available. The vulnerability is publicly known and has been disclosed [1].