CVE-2026-9361
published 2026-05-24CVE-2026-9361: A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request…
PriorityP354medium6.3CVSS 3.1
AVNACLPRLUINSUCLILAL
EPSS
1.16%
63.1th percentile
A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| edimax | ew-7438rpn | — | — |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
cvelistv5v4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v76m-wvxr-74j2: A weakness has been identified in Edimax EW-7438RPn 1
ghsa_unreviewed·2026-05-26
CVE-2026-9361 [LOW] CWE-74 GHSA-v76m-wvxr-74j2: A weakness has been identified in Edimax EW-7438RPn 1
A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVEList
Edimax EW-7438RPn POST Request formAccep formAccept command injection
cvelistv5·2026-05-24·CVSS 5.3
CVE-2026-9361 [MEDIUM] CWE-77 Edimax EW-7438RPn POST Request formAccep formAccept command injection
Edimax EW-7438RPn POST Request formAccep formAccept command injection
A weakness has been identified in Edimax EW-7438RPn 1.12. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Timeline: 2026-05-23: Advisory disclosed; 2026-05-23: VulDB entry created; 2026-05-23: VulDB entry last update
VulDB
Edimax EW-7438RPn 1.12 POST Request /goform/formAccep formAccept submit-url command injection
vuldb·2026-05-23
CVE-2026-9361 [CRITICAL] Edimax EW-7438RPn 1.12 POST Request /goform/formAccep formAccept submit-url command injection
A vulnerability was found in Edimax EW-7438RPn 1.12. It has been rated as critical. This affects the function formAccept of the file /goform/formAccep of the component POST Request Handler. This manipulation of the argument submit-url causes command injection.
This vulnerability appears as CVE-2026-9361. The attack may be initiated remotely. In addition, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-24
Published