This vulnerability affects Edimax EW-7438RPn devices running firmware versions 1.0 through 1.31. A stack-based buffer overflow arises from improper handling of the pinCode/wlan-url argument in the /goform/formWpsStart endpoint of the device's web component. The flaw allows remote attackers to potentially execute arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not issued a patch or official advisory, and remediation status is unknown.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or disrupt device operation, impacting confidentiality, integrity, and availability of the affected device. Given the high CVSS score and remote exploitability without user interaction, affected devices are at significant risk if exposed to untrusted networks. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, affected users should consider mitigating exposure by restricting network access to the device's management interface, disabling vulnerable services if possible, or replacing the device with a secure alternative until a patch is released.