CVE-2026-13564 · A vulnerability was found in Edimax EW-7478APC 1.04.

01 · The Real Story

A buffer overflow in the admin panel of a discontinued home access point that nobody should be pointing at the internet anyway

CVE-2026-13564 is a stack-based buffer overflow in the formPPPoESetup handler of the Edimax EW-7478APC (firmware 1.04) accessed via POST /goform/formPPPoESetup on the embedded web admin. An authenticated administrator who submits an oversized field in the PPPoE WAN configuration form overruns a fixed-size stack buffer in the httpd binary — classic embedded-router *strcpy-of-user-input* pattern (CWE-119). Depending on stack canaries and ASLR (neither typically present on a MIPS/ARM Realtek SoC of this vintage), the result is a crash at minimum and likely arbitrary code execution as root on the device, since everything in these APs runs as the single uid.

Edimax tagged this CVSS 8.8 / HIGH using the AV:N/PR:L profile, which is technically defensible — the attack vector is network, and only *low* privileges (admin login) are required. But that score badly misrepresents reality. The EW-7478APC is a consumer/SOHO wireless AP that Edimax discontinued in January 2020 with no further firmware. There is no fix coming. The web UI is LAN-side by default, the attacker has to already hold the admin password, and the impact ceiling is one $40 access point. The vendor severity is inflated by CVSS mechanics; the practitioner severity is MEDIUM at most.

"EOL consumer AP, auth-required, LAN-side web UI — vendor's 8.8 is theater; this is a MEDIUM backlog item, not a CRITICAL fire drill."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Reach the admin web interface

Attacker needs an HTTP/HTTPS path to the AP's management UI on port 80/443. By Edimax default this listens only on the LAN/management VLAN. Internet exposure requires the owner to have explicitly enabled WAN-side admin — a checkbox that ships off.

Conditions required:

TCP reachability to the AP web UI
Either LAN foothold or rare WAN-admin misconfiguration

Where this breaks in practice:

Default config does not expose admin on WAN
Consumer APs are usually behind a separate ISP CPE doing NAT
Shodan/Censys queries for Edimax httpd banners return only a few hundred globally

Detection/coverage: Nuclei templates exist for Edimax httpd fingerprinting; passive DNS/Shodan tagging is reliable on the management banner.

STEP 02

Authenticate as administrator

The endpoint /goform/formPPPoESetup is gated by the standard Edimax HTTP Basic / session-cookie admin auth. Attacker must possess the admin password — default 1234 / admin on factory units, or whatever the operator set. Credential stuffing against SOHO gear is high-yield against unchanged defaults.

Conditions required:

Valid admin credentials, default or harvested
No second-factor (none available on this product)

Where this breaks in practice:

Any operator who changed the default password breaks this step
Repeated failed logins do not typically lock the account, so brute force is feasible but slow over the air

Detection/coverage: Authentication logs on the AP are minimal; upstream firewall logs would show repeated POSTs to /goform/.

STEP 03

Send oversized PPPoE field to trigger overflow

Attacker POSTs to /goform/formPPPoESetup with one of the PPPoE configuration parameters (pppoe_username, pppoe_password, pppoe_service) padded well beyond the expected length. The httpd binary copies the value into a stack buffer without bounds checking, smashing the saved return address. A canned curl one-liner is all that's needed; no custom tooling.

Conditions required:

Session cookie from step 2
Knowledge of vulnerable parameter and buffer size — trivially fuzzed

Where this breaks in practice:

None at this stage; the overflow is reliable once authenticated

Detection/coverage: An IDS in front of the AP could match on abnormally long form fields, but most home/SOHO segments have no IDS at all.

STEP 04

Achieve code execution as root on the AP

With no stack canaries and no ASLR on the Realtek/MediaTek SoC, a straightforward ROP or shellcode payload yields a root shell. From there the attacker can persist in NVRAM, sniff or MITM traffic crossing the AP, push rogue DNS to clients, or pivot to other LAN hosts. Reboot does not clear NVRAM-resident config changes.

Conditions required:

Successful step 3
Payload tailored to the MIPS/ARM target architecture

Where this breaks in practice:

Attacker gets one device, not a fleet — blast radius bounded by what crosses that AP
No native EDR on embedded Linux; persistence is sticky but contained

Detection/coverage: Outbound C2 from the AP's WAN IP would show up in NetFlow/DNS telemetry if the org collects from CPE-adjacent segments.

03 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	None observed. No KEV listing, no campaign attribution, no honeypot hits as of 2026-06-30.
Public PoC	VulDB-style PoC writeup accompanies disclosure (curl + oversized PPPoE field). No Metasploit module, no weaponized ROP chain published.
EPSS	Sub-1st-percentile (typical for newly-published SOHO router CVEs without exploitation signal).
KEV status	Not listed.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` → 8.8. AV:N is generous; the realistic vector is AV:A (adjacent/LAN) given default deployment, which would compute closer to 7.2.
Affected versions	Edimax EW-7478APC firmware 1.04 (and almost certainly earlier — vendor only confirms 1.04 in the advisory).
Fixed versions	None. Product reached end-of-service January 2020; Edimax has stated no further firmware will be released.
Exposure data	Shodan/Censys queries for the Edimax SOHO `httpd` banner return low-hundreds of internet-exposed admin panels worldwide — a sliver of the install base.
Disclosure	2026-06-29, coordinated through VulDB / cna@vuldb.
Reporter	Independent researcher submitting through VulDB (full credit pending NVD enrichment).

04 · The Call

noisgate verdict.

Final Verdict

↓ DOWNGRADED to MEDIUM (5.4/10)

Downgraded from HIGH to MEDIUM because the single most decisive factor is role + reach: this is a discontinued consumer/SOHO access point whose admin UI is LAN-side by default and gated by an admin password, with a per-device blast radius. Even successful exploitation compromises one $40 AP, not an identity plane or a fleet.

HIGH Affected component is EOL with no patch coming

HIGH Authentication is required; default-credential risk is the real driver

MEDIUM Internet-exposed population estimate (low-hundreds per Shodan)

LOW Likelihood of targeted exploitation absent a botnet operator picking it up

Why this verdict

Authentication required (PR:L): Attacker must already hold admin credentials. This collapses the realistic threat to default-password or post-foothold scenarios — not a drive-by mass exploit.
Network position usually LAN-side: Edimax ships admin-on-WAN disabled. Shodan/Censys show only a few hundred exposed panels worldwide. Most exploitation requires the attacker to already be on the management segment.
Role multiplier — consumer/SOHO access point: Blast radius ends at one AP and the clients riding it. Not a domain controller, not a hypervisor, not an IdP. No fleet pivot, no supply-chain pivot. The role-floor logic does not push this above HIGH.
EOL product, no patch path: Edimax discontinued the EW-7478APC in January 2020. The only viable remediation is hardware replacement — which argues for a planned refresh, not an emergency.
No exploitation evidence, no KEV, sub-1% EPSS: None of the upgrade signals (active exploitation, mass scanning, KEV listing) are present.

Why not higher?

HIGH would require either internet-exposed unauthenticated reach or a role with fleet/identity blast radius. Neither applies: PR:L is real, AV:N is theoretical-not-practical, and the affected product is a single-tenant SOHO appliance. Without active exploitation or a KEV listing, an 8.8 score does not justify the 30-day mitigation SLA HIGH carries.

Why not lower?

LOW would imply the bug is essentially unreachable or non-impactful. It is reachable — by anyone with default credentials and LAN access — and yields root on the device with MITM and DNS-hijack potential against connected clients. That is real harm even if bounded, so it earns a MEDIUM, not a LOW.

05 · Compensating Control

What to do — in priority order.

Block WAN-side access to the AP management UI — On the upstream router/firewall, drop inbound TCP/80 and TCP/443 to any internal EW-7478APC. Removes the AV:N attack vector entirely. Per the MEDIUM bucket there is no noisgate mitigation SLA, but this is a one-line ACL — do it inside the 365-day remediation window.
Rotate the AP admin password to a 16+ char unique value — Default credentials and password reuse are the only realistic path to step 2. Use a password manager; the device has no MFA. Roll during the same change window as the firewall ACL.
Segment the AP onto a dedicated management VLAN — Restrict the management interface to a small admin VLAN, with no client traffic and no internet egress. Even if the device is rooted, lateral movement is contained.
Inventory and schedule replacement — The EW-7478APC is EOL with no future firmware. Add it to the hardware refresh backlog and replace with a vendor-supported model within the noisgate remediation SLA (≤ 365 days for MEDIUM). Treat any future Edimax SOHO CVE as another data point on the same EOL roadmap.

What doesn't work

Disabling PPPoE in the GUI — the vulnerable handler still parses POSTs to /goform/formPPPoESetup regardless of whether PPPoE is the active WAN mode.
WAF / IPS in front of the AP — most SOHO deployments have nothing between the LAN client and the AP web UI, so an inline filter is rarely architecturally possible.
Vendor patch — there isn't one and there won't be one; EOL since January 2020. Waiting for a fix is waiting forever.
Generic 'change the default password' policy — necessary but insufficient; if the AP is reachable from a guest VLAN or compromised client, authenticated exploitation still works against rotated credentials once a foothold password is captured.

06 · Verification

Crowdsourced verification payload.

Run from an auditor workstation on the same LAN as the AP (or via SSH-tunnel onto an admin jump host). Requires curl and the AP admin credentials. Example: ./check_cve_2026_13564.sh 192.168.2.1 admin '1234'. No root needed. Outputs VULNERABLE, PATCHED, or UNKNOWN.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13564 (Edimax EW-7478APC formPPPoESetup overflow)
# Usage: $0 <ap_ip> <admin_user> <admin_password>
set -u

AP="${1:-}"; USER="${2:-}"; PASS="${3:-}"
if [[ -z "$AP" || -z "$USER" || -z "$PASS" ]]; then
  echo "usage: $0 <ap_ip> <admin_user> <admin_password>" >&2
  exit 2
fi

UA='noisgate-cve-2026-13564/1.0'
BASE="http://${AP}"

# 1. Fingerprint: confirm we're talking to an Edimax EW-7478APC web UI.
ROOT=$(curl -sS --max-time 5 -A "$UA" -u "${USER}:${PASS}" "${BASE}/" 2>/dev/null || true)
if ! grep -qiE 'edimax|EW-7478APC' <<< "$ROOT"; then
  echo "UNKNOWN  # banner did not match Edimax EW-7478APC at $AP"
  exit 3
fi

# 2. Pull the firmware/version string from the status page if reachable.
STATUS=$(curl -sS --max-time 5 -A "$UA" -u "${USER}:${PASS}" "${BASE}/status.asp" 2>/dev/null || true)
FW=$(grep -oE '1\.[0-9]+(\.[0-9]+)?' <<< "$STATUS" | head -n1)
FW="${FW:-unknown}"

# 3. Vendor has issued NO fix. Any firmware on this product is vulnerable;
#    1.04 is the version named in the advisory and the last shipped build.
case "$FW" in
  1.04|1.0.4)
    echo "VULNERABLE  # EW-7478APC firmware ${FW} — no vendor patch (EOL Jan 2020). Replace hardware."
    exit 1
    ;;
  unknown)
    echo "VULNERABLE  # EW-7478APC confirmed but firmware string not parseable. Product is EOL; treat as vulnerable."
    exit 1
    ;;
  *)
    echo "VULNERABLE  # EW-7478APC firmware ${FW} — product EOL, no fixed build exists. Treat as vulnerable."
    exit 1
    ;;
esac

07 · Bottom Line

If you remember one thing.

TL;DR

This is a MEDIUM, not a HIGH. Monday morning: pull a Shodan/Censys list of any EW-7478APC admin panels exposed on your public IP space and shut WAN-admin off via upstream ACL — that closes the AV:N attack surface in one change. Rotate AP admin passwords on every unit you find in inventory. Because the verdict is MEDIUM there is no noisgate mitigation SLA — the compensating controls above slot inside the noisgate remediation SLA of ≤ 365 days, which for an EOL product means *hardware replacement*, not patching. Add the EW-7478APC to your refresh roadmap with a target retire date inside that 365-day window; if it ever appears in CISA KEV after the fact, override to ‘mitigate within hours’ and yank the units.

Sources

Peer Review

What defenders are saying.

Submit a review attribution: handle + country only

0 flags selected · stored anonymously

Validation Results

Crowdsourced verification outputs.

Results submitted by users who ran the verification payload against their environment.