Edimax EW-7438RPn formWpsProxyEnable stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in Edimax EW-7438RPn wireless extender firmware version 1.31. The flaw is located in the formWpsProxyEnable function of the /goform/formWpsProxyEnable handler. The submit-url parameter is copied to a fixed-size stack buffer without proper length validation, enabling an attacker to overwrite the return address and hijack execution control. The affected device runs firmware version 1.31.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP POST request to /goform/formWpsProxyEnable with an excessively long submit-url value. No authentication is required if the web interface is reachable over the network. The overflow can be triggered remotely, and a public proof-of-concept exploit is available [1].

Impact

Successful exploitation results in remote code execution with root privileges on the device. This allows the attacker to fully compromise the router, leading to potential disclosure of network traffic, alteration of device settings, and use as a pivot for further attacks.

Mitigation

No official fix or firmware update has been released by Edimax as of the publication date. The vendor did not respond to disclosure attempts [1]. Users should consider isolating or replacing the affected device. No known workarounds exist.