The Edimax EW-7438RPn device firmware versions up to 1.31 contain a stack-based buffer overflow vulnerability in the web component handling the /goform/formWpsStart endpoint. Specifically, improper handling of the pinCode or wlan-url parameters allows an attacker to overflow the stack buffer remotely, potentially leading to code execution or denial of service. The vulnerability requires no user interaction and has a CVSS 4.0 score of 8.7, indicating high impact with network attack vector and low attack complexity. The vendor has not provided any patch or official remediation, and the exploit code has been publicly disclosed.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on the affected device. Given the network attack vector and lack of required privileges or user interaction, the vulnerability poses a significant risk to the confidentiality, integrity, and availability of the device. However, there are no confirmed reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting network access to the device's management interface and monitoring for suspicious activity. Avoid exposing the device's web interface to untrusted networks until an official patch is available.