CVE-2020-37096

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface. Attackers can craft malicious web pages to trick users into adding unauthorized MAC addresses to the device's filtering rules without their consent.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
EDIMAX Technology Co., Ltd.	EW-7438RPn Mini	1.13

References

https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/Product
https://www.exploit-db.com/exploits/48366Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/edimax-ew-rpn-cross-site-request-forgery-mac-filteringBroken Link

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-370977.5Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencryp CVE-2020-370987.8Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-370997.8Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to po CVE-2020-37107.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371007.8Sync Breeze Enterprise 12.4.18 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with el CVE-2020-371017.8VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the servi CVE-2020-371027.8Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to pote CVE-2020-371035.4DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executab CVE-2020-371047.5ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by pred CVE-2020-371057.1PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrar CVE-2020-371065.3Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user account roles witho CVE-2020-371077.5Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the account field w