Edimax EW-7478APC Stack-Based Buffer Overflow in formL2TPSetup (L2TPUserName)

#!/usr/bin/env bash
# check_cve_2026_13563.sh — Detect Edimax EW-7478APC vulnerable to CVE-2026-13563
# Usage: bash check_cve_2026_13563.sh <TARGET_IP>
# Requires: curl
# Exit codes: 0=VULNERABLE, 1=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <TARGET_IP>"
  exit 2
fi

echo "[*] Probing $TARGET for Edimax EW-7478APC ..."

# Attempt to fetch the login/status page
RESPONSE=$(curl -sk --connect-timeout 5 --max-time 10 "http://${TARGET}/" 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  echo "[?] UNKNOWN — could not reach http://${TARGET}/"
  exit 2
fi

# Check if this is an Edimax device
if ! echo "$RESPONSE" | grep -qi 'edimax'; then
  echo "[−] PATCHED / NOT AFFECTED — device at $TARGET is not an Edimax AP"
  exit 1
fi

# Check for EW-7478APC model identifier
if ! echo "$RESPONSE" | grep -qi 'EW-7478APC'; then
  echo "[−] PATCHED / NOT AFFECTED — Edimax device at $TARGET is not model EW-7478APC"
  exit 1
fi

# Check for firmware version 1.04
if echo "$RESPONSE" | grep -qi '1\.04'; then
  echo "[!] VULNERABLE — Edimax EW-7478APC firmware 1.04 detected at $TARGET"
  echo "    CVE-2026-13563: Stack-based buffer overflow in formL2TPSetup (L2TPUserName)"
  echo "    Action: Decommission this device immediately. No patch exists (EoL since 2020-01-10)."
  exit 0
fi

# Check for the vulnerable endpoint
ENDPOINT=$(curl -sk --connect-timeout 5 --max-time 10 -o /dev/null -w '%{http_code}' "http://${TARGET}/goform/formL2TPSetup" 2>/dev/null || echo "000")

if [[ "$ENDPOINT" == "200" || "$ENDPOINT" == "401" || "$ENDPOINT" == "403" ]]; then
  echo "[!] VULNERABLE — Edimax EW-7478APC detected at $TARGET with formL2TPSetup endpoint present"
  echo "    CVE-2026-13563: Stack-based buffer overflow in formL2TPSetup (L2TPUserName)"
  echo "    Action: Decommission this device immediately. No patch exists (EoL since 2020-01-10)."
  exit 0
fi

echo "[?] UNKNOWN — Edimax EW-7478APC detected but could not confirm firmware version"
exit 2