CVE-2026-9480

HighCVSS 8.8/10Last modified Jul 23, 2026

Description

A vulnerability was detected in Edimax EW-7438RPn 1.31. The impacted element is the function formrefresh of the file /goform/formrefresh. The manipulation of the argument submit-url results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-121

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-94818.8A flaw has been found in Edimax EW-7438RPn 1.31. This affects the function formStats of the file /goform/formStats. This manipulation of theCVE-2026-94828.8A vulnerability has been found in Edimax EW-7438RPn 1.31. This impacts the function formSDHCP of the file /goform/formSDHCP. Such manipulatiCVE-2026-94836.3A vulnerability was found in SourceCodester Student Grades Management System 1.0. Affected is an unknown function of the file grades.php. PeCVE-2026-94846.3A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClaCVE-2026-94853.5A vulnerability was identified in SourceCodester Student Grades Management System 1.0. Affected by this issue is some unknown functionality CVE-2026-94864.3A security flaw has been discovered in SourceCodester Student Grades Management System 1.0. This affects an unknown part. The manipulation rCVE-2026-94879.1XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify()CVE-2026-94898.5NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses aCVE-2026-94905.5A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security DescriptCVE-2026-94914.3A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users toCVE-2026-94927.8The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access ContCVE-2026-94936.5Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remot