This vulnerability involves a buffer overflow in the Edimax EW-7438RPn 1.28a device within the formwlencrypt24g function of the POST request handler component. An attacker can remotely manipulate the key1 parameter in the /goform/formwlencrypt24g endpoint to trigger the overflow. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not issued any fix or advisory, and the exploit is publicly available.

Successful exploitation of this vulnerability could allow a remote attacker to cause a buffer overflow, potentially leading to denial of service or remote code execution on the affected device. Given the high CVSS score and remote attack vector, this poses a significant risk to the confidentiality, integrity, and availability of the device and network it resides on.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider disabling remote access to the affected endpoint or isolating the device from untrusted networks until a patch or official mitigation is available. Monitor for any updates from Edimax regarding this vulnerability.