Edimax EW-7438RPn formRadius stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in the formRadius function within the /goform/formRadius endpoint of Edimax EW-7438RPn firmware version 1.31 [1]. The submit-url argument is copied directly into a stack buffer without proper bounds checking, allowing an attacker to overflow the buffer and overwrite the return address [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to /goform/formRadius with an overly long submit-url parameter [1]. The provided PoC demonstrates sending a long string of 'a' characters, which causes the router to crash [1]. No authentication is required, and the attack can be performed over the network.

Impact

Successful exploitation causes a denial of service (device crash). Since the return address is overwritten, an attacker may also achieve arbitrary code execution with the privileges of the web server process, allowing full compromise of the device [1].

Mitigation

The vendor was contacted but did not respond, and no official patch or firmware update has been released [1]. As a workaround, restrict network access to the device's web interface and block untrusted traffic to the affected endpoint. Consider replacing the device if it remains unpatched.