The Edimax EW-7438RPn device running firmware version 1.31 contains a stack-based buffer overflow vulnerability in the formWpsProxyEnable function located in /goform/formWpsProxyEnable. The flaw is triggered by manipulating the submit-url parameter, leading to memory corruption on the stack. This vulnerability is remotely exploitable without authentication or user interaction. The vendor was notified but has not issued any patch or mitigation guidance. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation of this vulnerability can lead to arbitrary code execution or denial of service on the affected device. Because it is remotely exploitable without authentication or user interaction, attackers can potentially compromise the device over the network. The high CVSS score reflects significant impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet, but public exploit code exists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or released a fix as of the published date. Until an official patch is available, consider restricting network access to the affected device, especially to the /goform/formWpsProxyEnable endpoint, to reduce exposure. Monitor for updates from Edimax regarding remediation.