A security vulnerability has been detected in Edimax EW-7478APC 1

CVE-2026-13560 is a command injection flaw (CWE-77) in the Edimax EW-7478APC v1.04, an AC1200 dual-band SOHO/consumer access point. An attacker who already has valid management-plane credentials can submit crafted input to a web-management handler and have it concatenated into a shell command, yielding code execution as the embedded web service account — which on these MIPS/Realtek SDK builds is effectively root. The advisory currently lists only firmware revision 1.04 as affected; Edimax has not historically published per-CVE fixed-firmware tables for this generation of hardware, and the EW-7478APC has been on the tail end of its support window for years.

Vendor severity of MEDIUM (6.3) is roughly fair on paper. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects the two big brakes: you need credentials (PR:L) and impact is bounded to the device itself (S:U, partial CIA). What CVSS does *not* capture is that on a SOHO AP the PR:L requirement is frequently the default admin/1234-class password, and the device sits on the trust boundary between Wi-Fi clients and the wired LAN. We hold at MEDIUM but it sits at the top of the bucket.

Why this verdict

• Authentication required (PR:L) — eliminates drive-by mass exploitation; attacker must phish, brute-force, or rely on default credentials.
• Scope unchanged, partial CIA — the impact is the device, not the directory, not the hypervisor, not a CA. CVSS sub-score math sits at 5.5–6.3.
• Role multiplier: Even in the worst plausible enterprise role (a guest-Wi-Fi AP in a branch office), blast radius stops at intercepting that subnet's traffic — not a fleet-scale outcome. The EW-7478APC is not a canonical high-value-role component, so no CRITICAL floor applies.
• Exposure population is small — Edimax SOHO APs are not common in 10,000-host enterprises; where present they are usually lab/guest gear.
• No KEV, no PoC, no campaign at disclosure — pure 0-day risk, not an active fire.

Why not higher?

Upgrading to HIGH would require either an auth bypass (none disclosed), a high-value-role deployment pattern (not the case for a consumer AP), or active in-the-wild exploitation (none). The vendor's PR:L rating is accurate and meaningfully limits the attacker population.

Why not lower?

Downgrading to LOW would ignore that default credentials on SOHO gear are a near-universal foothold and that command injection yields root on these Realtek SDK builds. Any device exposed to a guest LAN or, worse, the internet is a one-credential-away pivot point.

1. Inventory all Edimax EW-7478APC units across the fleet — You cannot patch what you cannot find. Run an authenticated network scan or pull from your asset DB for MAC OUI 00:1F:1F, 74:DA:38, 80:1F:02 (Edimax) cross-referenced to HTTP banner strings. No mitigation SLA for MEDIUM, but complete inventory inside the 365-day remediation window.
2. Confirm management plane is LAN/VLAN-only — Block TCP/80 and TCP/443 to every Edimax management IP from the WAN edge and from guest/user VLANs. ACL on the upstream switch or firewall — this neutralizes the remote attacker entirely and is your strongest control while you wait for firmware.
3. Force a credential rotation on every unit — If PR:L is your only defense, make it count. Generate per-device 20-character random passwords, store in your PAM/secret manager. Removes the default-credential mass-exploit risk.
4. Plan device replacement for EOL units — If Edimax does not ship fixed firmware within 90 days of disclosure (their track record on this generation is poor), schedule hardware refresh to an actively supported vendor inside the 365-day remediation window.

Run on an auditor workstation with network reachability to suspected Edimax APs. Invoke as ./check_cve-2026-13560.sh 10.0.0.0/24. Requires nmap and curl; no credentials needed for the banner-grab check. Reports VULNERABLE if an EW-7478APC management UI is reachable AND firmware 1.04 is fingerprinted.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-13560 — Edimax EW-7478APC command injection
# Usage: ./check_cve-2026-13560.sh <CIDR-or-IP>
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <cidr-or-ip>" >&2
  exit 2
fi
for dep in nmap curl; do
  command -v "$dep" >/dev/null 2>&1 || { echo "UNKNOWN: missing $dep"; exit 3; }
done

FOUND_VULN=0
FOUND_ANY=0

# 1. Identify hosts with TCP/80 or /443 open
HOSTS=$(nmap -Pn -n -p80,443 --open -oG - "$TARGET" 2>/dev/null | awk '/Ports:/ {print $2}')
for h in $HOSTS; do
  for scheme in http https; do
    BODY=$(curl -sk --max-time 5 "$scheme://$h/" 2>/dev/null)
    HDR=$(curl -skI --max-time 5 "$scheme://$h/" 2>/dev/null)
    if echo "$BODY $HDR" | grep -qiE 'EW-7478APC|Edimax'; then
      FOUND_ANY=1
      # Version fingerprint: firmware string commonly appears in /status.asp or /info.htm
      VER=$(curl -sk --max-time 5 "$scheme://$h/status.asp" 2>/dev/null | grep -oE '1\.0[0-9]+' | head -1)
      if [[ "$VER" == "1.04" ]]; then
        echo "VULNERABLE: $h firmware $VER (EW-7478APC)"
        FOUND_VULN=1
      elif [[ -n "$VER" ]]; then
        echo "PATCHED-OR-OTHER: $h firmware $VER"
      else
        echo "UNKNOWN: $h is an Edimax device but firmware could not be read without auth"
      fi
    fi
  done
done

if [[ $FOUND_VULN -eq 1 ]]; then
  exit 1
elif [[ $FOUND_ANY -eq 0 ]]; then
  echo "PATCHED: no Edimax EW-7478APC management UIs reachable in $TARGET"
  exit 0
else
  exit 0
fi

Sources

1. CVE.org record CVE-2026-13560
2. Feedly: Latest Edimax Vulnerabilities
3. Vulmon: Edimax vulnerabilities and exploits
4. Edimax EW-7478APC product/support page
5. CWE-77: Command Injection
6. OWASP Command Injection
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS