This vulnerability affects the Edimax EW-7438RPn device running firmware version 1.31. The flaw exists in the /goform/formConnectionSetting endpoint, specifically in the formConnectionSetting function. By sending crafted values for the max_Conn/timeOut parameter, an attacker can trigger a stack-based buffer overflow remotely. This could potentially allow execution of arbitrary code or cause denial of service. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not provided any fix or advisory, and no official remediation level is assigned.

Successful exploitation of this vulnerability could lead to remote code execution or denial of service on the affected device. Because the attack can be performed remotely without authentication or user interaction, the risk to exposed devices is significant. The public availability of exploit code further increases the likelihood of exploitation. There is currently no known patch or vendor mitigation, leaving affected devices vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider mitigating exposure by restricting network access to the affected device, disabling vulnerable services if possible, or replacing the device with a secure alternative until an official fix is available.