CVE-2026-9346

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

A flaw has been found in Edimax EW-7438RPn up to 1.31. This impacts the function formWirelessTbl of the file /goform/formWirelessTbl of the component webs. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-120

Affected software

No affected versions have been published.

Timeline

Published
May 24, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-934605.1A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploitedCVE-2026-934626.9A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may oCVE-2026-934635.1A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary scripCVE-2026-934645.1A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitCVE-2026-934679.8The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code onCVE-2026-934687.5The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path TraversCVE-2026-93476.3A vulnerability has been found in Edimax EW-7438RPn up to 1.31. Affected is the function formWizSurvey of the file /goform/formWizSurvey of CVE-2026-934718.7Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exhCVE-2026-934746.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-934759.3The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size bufferCVE-2026-934775.9Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the valCVE-2026-934798.1A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log for