SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-19959 2026-08-16

CVE-2026-19959: Critical Stack Buffer Overflow in Edimax EW-7478APC

"A publicly disclosed stack-based buffer overflow in the Edimax EW-7478APC access point could allow remote, low-privilege attackers to compromise the device; and, according to the disclosing researcher, the vendor has…"

A publicly disclosed stack-based buffer overflow in the Edimax EW-7478APC access point could allow remote, low-privilege attackers to compromise the device; and, according to the disclosing researcher, the vendor has not responded to the disclosure.

What Is It

CVE-2026-19959 is a stack-based buffer overflow (CWE-121, CWE-119) in the formWanTcpipSetup function of /goform/formWanTcpipSetup on the Edimax EW-7478APC, firmware version 1.04. An attacker manipulates the pppUserName argument to overflow the stack buffer.

The flaw is remotely exploitable over the network with low attack complexity and no user interaction, requiring only low-level privileges. NVD assigns a CVSS 3.1 base score of 9.9 (CRITICAL): AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a scope change reflecting impact beyond the vulnerable component. The CVSS 4.0 score is 8.6 (HIGH) with exploit maturity rated Proof-of-Concept.

Why It Matters

The exploit has been made publicly available and could be used for attacks. Public PoC availability tends to narrow the gap between disclosure and opportunistic scanning, particularly for internet-facing networking gear.

Compounding this: the researcher reports that the vendor was contacted early about the disclosure but did not respond. There is no coordinated fix timeline and no vendor advisory.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; no KEV entry was supplied, so there is no confirmation of active in-the-wild exploitation and no federal remediation deadline attached to it.

What's Vulnerable

No other products or versions are listed in the supplied record.

Patch Status

No patch is identified in the supplied source material. The vendor is reported not to have responded to the disclosure, and no fixed version, advisory, or required action has been published. No CISA-mandated remediation action applies, as the CVE is not in the KEV catalog.

Operators running EW-7478APC 1.04 should treat the device's web management interface as exposed and restrict network access to it in the absence of a vendor fix.

Sources