Edimax EW-7438RPn formSDHCP stack-based overflow

Vulnerability

The vulnerability is a stack-based buffer overflow in the formSDHCP function of the /goform/formSDHCP endpoint in Edimax EW-7438RPn firmware version 1.31. The submit-url parameter is copied directly into a stack buffer without length validation, allowing an oversized input to overwrite the return address. The affected product is an extender, and the vulnerability is present in the webs binary. [1]

Exploitation

An attacker can exploit this remotely by sending a crafted HTTP POST request to the /goform/formSDHCP endpoint with an overly long submit-url value. No authentication is required, as the PoC shows a request with basic authorization but the vulnerability is reachable without it. The attacker can cause a crash or, with careful payload construction, achieve arbitrary code execution. The exploit has been publicly disclosed. [1]

Impact

Successful exploitation allows an attacker to crash the device (denial of service) or execute arbitrary code with the privileges of the web server process. This could lead to full compromise of the device, including unauthorized access to network traffic or further attacks on the local network. [1]

Mitigation

As of the publication date, the vendor has not responded to disclosure and no patch is available. Users should consider isolating the device from untrusted networks or replacing it if possible. No workaround is provided. The vulnerability is not listed in CISA KEV as of this writing. [1]