A publicly disclosed stack-based buffer overflow in the Edimax EW-7478APC access point could allow remote, low-privilege attackers to compromise the device; and, according to the disclosing researcher, the vendor has not responded to the disclosure.
What Is It
CVE-2026-19959 is a stack-based buffer overflow (CWE-121, CWE-119) in the formWanTcpipSetup function of /goform/formWanTcpipSetup on the Edimax EW-7478APC, firmware version 1.04. An attacker manipulates the pppUserName argument to overflow the stack buffer.
The flaw is remotely exploitable over the network with low attack complexity and no user interaction, requiring only low-level privileges. NVD assigns a CVSS 3.1 base score of 9.9 (CRITICAL): AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a scope change reflecting impact beyond the vulnerable component. The CVSS 4.0 score is 8.6 (HIGH) with exploit maturity rated Proof-of-Concept.
Why It Matters
The exploit has been made publicly available and could be used for attacks. Public PoC availability tends to narrow the gap between disclosure and opportunistic scanning, particularly for internet-facing networking gear.
Compounding this: the researcher reports that the vendor was contacted early about the disclosure but did not respond. There is no coordinated fix timeline and no vendor advisory.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no KEV entry was supplied, so there is no confirmation of active in-the-wild exploitation and no federal remediation deadline attached to it.
What's Vulnerable
- Vendor: Edimax
- Product: EW-7478APC
- Affected version: 1.04
- Affected component:
formWanTcpipSetupin/goform/formWanTcpipSetup - Attack parameter:
pppUserName - CPE:
cpe:2.3:a:edimax:ew-7478apc:*:*:*:*:*:*:*:*
No other products or versions are listed in the supplied record.
Patch Status
No patch is identified in the supplied source material. The vendor is reported not to have responded to the disclosure, and no fixed version, advisory, or required action has been published. No CISA-mandated remediation action applies, as the CVE is not in the KEV catalog.
Operators running EW-7478APC 1.04 should treat the device's web management interface as exposed and restrict network access to it in the absence of a vendor fix.
Sources
- NVD, CVE-2026-19959: https://nvd.nist.gov/vuln/detail/CVE-2026-19959
- VulDB, CVE-2026-19959: https://vuldb.com/cve/CVE-2026-19959
- VulDB, Vulnerability Entry 391136: https://vuldb.com/vuln/391136
- VulDB, CTI Data for 391136: https://vuldb.com/vuln/391136/cti
- VulDB, Submission 872873: https://vuldb.com/submit/872873
- Researcher Write-up; EDIMAX EW-7478APC formWanTcpipSetup: https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formWanTcpipSetup-34b53a41781f8047b36bd11dbcaa84dc