A vulnerability has been found in Edimax EW-7478APC 1

CVE-2026-13563 is a CWE-119 memory corruption flaw in the Edimax EW-7478APC firmware 1.04, an AC1200 dual-band consumer/SOHO access point. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) describes an *authenticated* network-reachable overflow in the web management interface — a logged-in attacker can corrupt memory to achieve code execution or crash the device. Affected: firmware 1.04 on the EW-7478APC hardware specifically.

Vendor scored this HIGH (8.8), which is technically defensible under raw CVSS math: low-complexity, network-reachable, full CIA impact. But the score ignores two facts that gut the real-world severity. First, the device is end-of-service — Edimax stopped firmware and OTA updates at end of November 2024, so there is no patch and there never will be one. Second, this is a residential/SOHO product, not enterprise gear; almost no managed fleet of 10,000 hosts should have one of these in scope. 8.8 overstates the practical risk for any defender it actually applies to.

Why this verdict

• Authenticated prerequisite (PR:L): The overflow is not reachable without valid admin credentials, which cuts out drive-by mass exploitation entirely.
• End-of-life product: Edimax stopped firmware updates Nov 2024. There is no patch to schedule — remediation = decommission, not 'apply hotfix'.
• Enterprise installed-base near zero: EW-7478APC is a residential AC1200 home AP. It does not show up in Cisco/Aruba/Meraki/Juniper-managed estates. Friction: <0.1% of enterprise wireless fleets.
• Role multiplier: Affected role is a SOHO access point — *not* a domain controller, IdP, hypervisor, CA, backup server, kernel-mode agent, or edge appliance. Blast radius caps at the broadcast domain the AP serves. No fleet-scale or supply-chain pivot path. Floor stays at MEDIUM, not HIGH.
• No exploitation signal: Not KEV, no public PoC, no EPSS percentile of concern, no Shodan-driven scanning surge linked to this CVE ID.

Why not higher?

HIGH would require either fleet-relevant deployment (this isn't an enterprise product) or unauthenticated exploitability (it's PR:L). Neither holds. CRITICAL would additionally require KEV listing or a high-value-role component — this is a consumer AP, the opposite of that.

Why not lower?

LOW/IGNORE would be defensible if you could prove zero EW-7478APC units exist in scope. For most enterprises that's true, but branch offices, home-office stipend purchases, and shadow-IT do put consumer APs on corporate edges. MEDIUM keeps it on the inventory-and-remove backlog rather than the ignore pile.

1. Inventory and decommission — Run a discovery sweep for the Edimax web UI fingerprint and replace any EW-7478APC units found with supported, currently-patched APs (Meraki/Aruba/Ubiquiti/etc.). Because the product is EOL with no patch path, replacement *is* the remediation — schedule within the noisgate remediation SLA (365 days for MEDIUM).
2. Rotate admin credentials and disable WAN admin — Until decommission, change the admin password from default, disable any 'remote/WAN management' toggle, and bind the management interface to an isolated mgmt VLAN. This neutralizes the PR:L prerequisite for any opportunistic attacker.
3. Segment the AP off sensitive networks — Treat any EW-7478APC as an untrusted bridge. Place it behind a firewall, restrict its uplink to a guest/iot VLAN, and block lateral routing to corp/server segments. If it gets popped, blast radius is contained to a non-trust zone.
4. Restrict mgmt UI by source IP — ACL the AP's HTTP/HTTPS admin to a single jump host or admin subnet. Even without a patch, narrowing the attacker population to 'people on the admin subnet with valid creds' collapses the practical risk.

Run this from an auditor workstation on the same L2/L3 segment as the suspected AP. Invocation: ./check_edimax.sh 192.168.2.1 (or the AP's management IP). No privileges required beyond network reachability. The script fingerprints the EW-7478APC web UI and flags v1.04 as VULNERABLE.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13563 (Edimax EW-7478APC 1.04 CWE-119)
# Usage: ./check_edimax.sh <ap-ip-or-hostname>
set -u
TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <ap-ip-or-hostname>" >&2
  exit 2
fi

CURL_OPTS=(-sk --max-time 5 -A 'noisgate/1.0')

# Pull the login / index page
BODY=$(curl "${CURL_OPTS[@]}" "http://${TARGET}/" 2>/dev/null || true)
HDRS=$(curl "${CURL_OPTS[@]}" -I "http://${TARGET}/" 2>/dev/null || true)

if [ -z "$BODY" ] && [ -z "$HDRS" ]; then
  echo "UNKNOWN: ${TARGET} did not respond on HTTP/80"
  exit 3
fi

# Fingerprint: EW-7478APC UI carries the model string and a version banner.
if ! echo "$BODY $HDRS" | grep -qiE 'EW-?7478APC|Edimax'; then
  echo "UNKNOWN: target does not fingerprint as Edimax EW-7478APC"
  exit 3
fi

# Try to extract firmware version from common Edimax status pages.
VER=$(curl "${CURL_OPTS[@]}" "http://${TARGET}/status.asp" 2>/dev/null \
      | grep -oE 'Firmware[^<]*[0-9]+\.[0-9]+(\.[0-9]+)?' | head -n1)
[ -z "$VER" ] && VER=$(echo "$BODY" | grep -oE '[Vv]?1\.04([^0-9]|$)' | head -n1)

if echo "$VER" | grep -qE '1\.04'; then
  echo "VULNERABLE: EW-7478APC firmware 1.04 detected on ${TARGET} (CVE-2026-13563)"
  echo "  Note: product is end-of-service — no vendor patch. Decommission/replace."
  exit 1
elif [ -n "$VER" ]; then
  echo "PATCHED-or-OTHER: EW-7478APC detected, firmware string='${VER}' (not 1.04)"
  exit 0
fi

echo "UNKNOWN: EW-7478APC fingerprinted but firmware version not parseable"
exit 3

Sources

1. Edimax End-of-Service Announcement
2. Edimax EW-7478APC product page
3. Edimax EW-7478APC user manual (firmware reference)
4. Feedly — Latest Edimax Vulnerabilities
5. VulDB — related Edimax SOHO CVE cluster (CVE-2026-12810)
6. Erebua/CVE — Edimax disclosure tracker
7. CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
8. CISA KEV Catalog (for negative confirmation)