CVE-2026-13564 · Edimax EW-7478APC formPPPoESetup Stack-Based Buffer Overflow via…

01 · The Real Story

Like finding a live grenade in a junk drawer — dangerous if you hold one, but most enterprises cleaned that drawer years ago

CVE-2026-13564 hits the formPPPoESetup function in /goform/formPPPoESetup on the Edimax EW-7478APC wireless access point running firmware 1.04. An authenticated attacker sends an oversized pppUserName parameter via HTTP POST, overflowing a fixed-size stack buffer on the underlying MIPS Linux system. With no ASLR or stack canaries, successful exploitation trivially yields remote code execution as root. Only firmware 1.04 is known to be affected — the sole release for this model, EOL'd January 10, 2020. The EW-7478APC is one of a family of Edimax consumer APs hit by a cluster of similar CVEs (CVE-2026-19959, -19960, -19961, -13580, -13583) in the same disclosure window, all targeting different goform handlers with the same class of stack overflow.

The vendor's HIGH 8.8 CVSS score is technically accurate for the raw exploitability math — network-adjacent, low complexity, low privileges, full CIA impact — but it dramatically overstates real-world enterprise risk. The CVSS vector says AV:N and PR:L, which maps to 'any authenticated user on the LAN can own it.' In practice, the management interface binds to 192.168.2.1 and is reachable only from the local subnet. The device is a $50 consumer/SOHO AC1200 AP discontinued over six years ago with near-zero presence in managed enterprise networks. Organizations running 10K hosts deploy Cisco, Aruba, or Meraki — not discontinued Edimax consumer gear. The correct enterprise action is asset discovery and retirement, not vulnerability remediation.

"Dead consumer AP, public exploit, zero enterprise footprint — retire it, don't patch it"

02 · The Attack Path

4 steps from start to impact.

STEP 01

Reach the management interface

The attacker must have Layer 2/Layer 3 connectivity to the EW-7478APC's management subnet (default 192.168.2.0/24). The web interface listens on port 80 (HTTP) at 192.168.2.1. No external-facing exposure exists unless the operator has explicitly bridged or port-forwarded the management interface, which is not a supported configuration.

Conditions required:

LAN or WLAN access to the device's management subnet

Where this breaks in practice:

Enterprise networks segment wireless management planes
The device is almost never present in managed environments
Attacker must already be on the local network (post-initial-access)

Detection/coverage: Shodan/Censys show negligible internet exposure for this model. Internal network scans for Edimax HTTP fingerprints on port 80 would identify the device.

STEP 02

Authenticate to the web interface

The CVSS vector specifies PR:L. The attacker needs valid credentials for the HTTP admin panel. Default credentials are admin / 1234. Consumer devices of this age rarely have changed passwords. No lockout mechanism exists on the device.

Conditions required:

Valid credentials (default admin/1234 or guessed)

Where this breaks in practice:

Low friction — defaults are well-documented and common
If credentials have been changed, brute-force is trivial with no lockout

Detection/coverage: No standard EDR or SIEM integration on the device. HTTP auth attempts logged only in the device's local syslog buffer (limited, rarely forwarded).

STEP 03

Send the malicious POST request

The attacker sends a crafted HTTP POST to /goform/formPPPoESetup with an oversized pppUserName parameter, overflowing the stack buffer in the formPPPoESetup function. The PoC was disclosed via VulDB submission 844114 by researcher wxhwxhwxh_mie. No Metasploit or nuclei module exists, but the overflow is straightforward to reproduce on MIPS.

Conditions required:

Authenticated HTTP session
Knowledge of the vulnerable endpoint and parameter

Where this breaks in practice:

MIPS ROP chain development required for reliable code execution beyond a crash
No off-the-shelf exploit framework module available

Detection/coverage: WAF/IPS rules for oversized POST parameters to /goform/ paths would catch this. No vendor-supplied detection signature exists.

STEP 04

Achieve root shell on the AP

Successful exploitation yields a root shell on the underlying Linux/MIPS system. The attacker controls the access point — can sniff wireless traffic, pivot to the LAN segment, modify DNS responses, or brick the device. Blast radius is limited to one network segment.

Conditions required:

Successful stack overflow exploitation in Step 3

Where this breaks in practice:

No domain credentials or lateral movement tooling on the AP
No persistence mechanism survives device reboot
AP has no integration with AD, RADIUS tokens, or enterprise secrets

Detection/coverage: Anomalous traffic from the AP's management IP (outbound connections, port scans) would be visible to NDR/NTA tools.

03 · Compensating Control

MEDIUM 5.0→IGNORE 0.0

SEVERITY REDUCED

Decommission and physically replace all EW-7478APC units — This is a permanently vulnerable, end-of-life consumer AP with no patch path. The only real remediation is physical removal. Identify units via asset inventory, MAC OUI lookup (Edimax OUI 80:1F:02, 00:1F:1F, 00:0E:2E), or network scanning for the Edimax HTTP fingerprint on port 80. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.

MEDIUM 5.0→LOW 3.0

SEVERITY REDUCED

Isolate the management interface on a dedicated VLAN with ACLs — If immediate removal is not feasible, place the device on an isolated management VLAN. Restrict access to 192.168.2.0/24 to authorized admin stations only via switch ACLs or firewall rules. This breaks Step 1 (network reachability) of the attack path.

MEDIUM 5.0→MEDIUM 4.5

Change default credentials to a strong unique password — Replace the default admin/1234 login. Without default creds, the attacker needs credential theft or brute-force. Raises the bar for Step 2 (authentication), though the device has no lockout mechanism.

MEDIUM 5.0→MEDIUM 4.0

Deploy IPS rules blocking oversized POST parameters to /goform/ endpoints — If an inline IPS sits in front of the device, block POST requests to /goform/formPPPoESetup with pppUserName values exceeding 64 bytes. Blocks the known PoC vector but leaves other overflow CVEs in the same device unmitigated.

What doesn't work

Firmware update — No patch exists. Edimax ended support January 10, 2020 and did not respond to disclosure. Waiting for a fix is futile.
EDR/endpoint agents — This is a MIPS-based embedded Linux device. No endpoint security agent runs on it. Host-based detection is not an option.
Disabling the web interface — The EW-7478APC has no CLI or API management mode. The web interface is the only management path and cannot be disabled.
MAC filtering or wireless security hardening — These control wireless client access, not management interface exploitation. They do not mitigate this CVE.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	No known active exploitation. Not on CISA KEV. No GreyNoise or Shadowserver scan activity observed for this device model.
Proof of Concept	Public. Disclosed via VulDB submission 844114 by researcher wxhwxhwxh_mie. PoC demonstrates the stack overflow via crafted POST to `/goform/formPPPoESetup`. No dedicated GitHub repo found. Not indexed in Metasploit or nuclei templates.
EPSS Score	0.00805 (0.80%), approximately 54th percentile. Low predicted exploitation probability.
KEV Status	Not listed as of 2026-10-02.
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH). Network-adjacent in practice (LAN-only mgmt interface). PR:L = default creds `admin/1234`. Full CIA impact on the device itself.
Affected Versions	Edimax EW-7478APC firmware 1.04 (the only known firmware release for this model).
Fixed Version	None. No patch exists. Device reached End of Support on January 10, 2020. Vendor did not respond to disclosure.
Exposure Data	Negligible internet-facing exposure per Shodan/Censys/FOFA. Management interface defaults to LAN-only at 192.168.2.1:80.
Disclosure Date	2026-06-29 (NVD published). VulDB submission by wxhwxhwxh_mie.
Related CVEs	Part of a cluster: CVE-2026-19959, CVE-2026-19960, CVE-2026-19961, CVE-2026-13580, CVE-2026-13583 — all affecting the same device/firmware with similar buffer overflows.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to MEDIUM (5.0/10)

Why this verdict

Near-zero enterprise installed base: The EW-7478APC is a discontinued $50 consumer/SOHO AC1200 AP. Organizations managing 10,000+ hosts deploy enterprise-grade APs (Cisco, Aruba, Meraki). The probability of this device existing in a managed enterprise is effectively zero, removing the population the CVSS score assumes.
LAN-only management interface negates AV:N scoring: The management interface binds to 192.168.2.1 on the local subnet. Reaching it requires the attacker to already be on the same L2 segment — post-initial-access. This is functionally AV:A (adjacent), which alone drops the base score to ~8.0 before other adjustments.
Role multiplier: No high-value role applies. The EW-7478APC is a consumer wireless AP. It does not function as a network edge appliance, identity provider, hypervisor, CI/CD component, backup system, PKI, PAM, or any canonical high-value role. Compromising it yields a root shell on one isolated embedded device. Blast radius = one network segment. No domain credentials, no fleet pivot, no supply-chain impact. The high-value role floor does NOT apply.
EOL device with no patch path: Discontinued January 10, 2020. No firmware update will ever arrive. The correct remediation is device retirement, not patching. This is an asset hygiene issue, not a vulnerability management issue.
Low threat intelligence signal: EPSS 0.80% (54th percentile), not on KEV, no known campaigns, no Metasploit/nuclei module, no GreyNoise scan activity.

Why not higher?

The device has no enterprise deployment footprint and occupies no high-value infrastructure role. Exploitation requires LAN access (post-initial-access). Even if compromised, the blast radius is a single network segment with no identity, secrets, or fleet-scale impact. There is no installed-base evidence that ≥1% of these devices sit in high-value roles — because this device is not deployed in enterprises.

Why not lower?

The exploit is public, the overflow is straightforward on MIPS, and default credentials make authentication trivial. If any units exist in the environment (shadow IT, branch offices, labs), they are permanently vulnerable with no remediation path other than removal. The device could serve as a wireless traffic interception point or LAN pivot, which is non-trivial even though the blast radius is limited.

06 · Verification

Crowdsourced verification payload.

Run from any Linux/macOS auditor workstation with curl and network access to the target device. No elevated privileges required. Usage: bash check_cve_2026_13564.sh 192.168.2.1

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_13564.sh — Detect Edimax EW-7478APC vulnerable to CVE-2026-13564
# Usage: bash check_cve_2026_13564.sh <target-ip>
# Exit codes: 1=VULNERABLE, 0=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target-ip>"
  exit 2
fi

PORT=80
TIMEOUT=5

# Step 1: Check if the device is reachable and serves HTTP
echo "[*] Checking HTTP service on $TARGET:$PORT ..."
HTTP_RESP=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout "$TIMEOUT" "http://$TARGET:$PORT/" 2>/dev/null || true)

if [[ "$HTTP_RESP" == "000" ]]; then
  echo "[!] UNKNOWN — Cannot reach $TARGET:$PORT. Host may be down or filtered."
  exit 2
fi

# Step 2: Fingerprint the device
echo "[*] Fingerprinting device ..."
PAGE_CONTENT=$(curl -s --connect-timeout "$TIMEOUT" "http://$TARGET:$PORT/" 2>/dev/null || true)

if echo "$PAGE_CONTENT" | grep -qi "edimax\|EW-7478APC\|7478APC"; then
  echo "[+] Edimax device detected."
else
  echo "[-] PATCHED / NOT AFFECTED — Device at $TARGET does not appear to be an Edimax EW-7478APC."
  exit 0
fi

# Step 3: Check if the vulnerable endpoint exists
echo "[*] Checking for vulnerable endpoint /goform/formPPPoESetup ..."
ENDPOINT_RESP=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout "$TIMEOUT" "http://$TARGET:$PORT/goform/formPPPoESetup" 2>/dev/null || true)

if [[ "$ENDPOINT_RESP" == "401" || "$ENDPOINT_RESP" == "200" || "$ENDPOINT_RESP" == "302" ]]; then
  echo "[+] Vulnerable endpoint /goform/formPPPoESetup is present (HTTP $ENDPOINT_RESP)."
else
  echo "[-] PATCHED / NOT AFFECTED — Endpoint not found (HTTP $ENDPOINT_RESP)."
  exit 0
fi

# Step 4: Confirm model and firmware if possible
echo "[*] Attempting to identify firmware version ..."
FW_PAGE=$(curl -s --connect-timeout "$TIMEOUT" "http://$TARGET:$PORT/status.asp" 2>/dev/null || true)

if echo "$FW_PAGE" | grep -qi "1\.04\|EW-7478APC"; then
  echo "[!] VULNERABLE — Edimax EW-7478APC firmware 1.04 detected."
  echo "[!] Device is end-of-life (Jan 2020). No patch available. Recommend immediate decommission."
  echo "[!] CVE-2026-13564: Stack-based buffer overflow in formPPPoESetup (pppUserName)"
  exit 1
fi

# Edimax device with the endpoint but can't confirm exact model/FW
echo "[?] UNKNOWN — Edimax device with vulnerable endpoint detected, but could not confirm exact model/firmware."
echo "[?] Manual verification recommended. If this is an EW-7478APC, it is VULNERABLE."
exit 2