This vulnerability affects Edimax EW-7438RPn firmware version 1.31. The issue lies in the formStats function within the /goform/formStats endpoint, where improper handling of the submit-url argument leads to a stack-based buffer overflow. The vulnerability is remotely exploitable without authentication or user interaction, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The CVSS 4.0 base score is 8.7, indicating high severity. The vendor has not provided any advisory or patch, and the exploit code is publicly available.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code or crash the device, leading to denial of service. Given the lack of authentication and user interaction requirements, the attack surface is broad. The high CVSS score reflects the significant risk posed by this flaw. No vendor mitigation or patch is currently available, increasing the risk for affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider disabling or restricting access to the vulnerable endpoint if possible, or replace the device with a secure alternative. Monitor official Edimax channels for any forthcoming updates or patches.