CVE-2026-19961: Critical Buffer Overflow in Edimax EW-7478APC Wireless Router

Executive Summary

CVE-2026-19961 is a critical severity buffer overflow vulnerability discovered in the Edimax EW-7478APC wireless router, firmware version 1.04. The flaw resides in the formWlSiteSurvey function within the /goform/formWlSiteSurvey endpoint. Manipulation of the selSSID argument triggers a stack-based buffer overflow, enabling unauthenticated remote code execution.

CVSS Score: 9.9 (Critical)

A public exploit is available, significantly elevating the risk for exposed devices. Network administrators and home users running this router model should treat this as a high-priority remediation.

Vulnerability Overview

Root Cause

The vulnerability stems from insufficient bounds checking on user-supplied input in the selSSID parameter processed by the formWlSiteSurvey function. When a specially crafted value is submitted to the /goform/formWlSiteSurvey endpoint, the router copies the input into a fixed-size stack buffer without validating its length, resulting in a classic stack buffer overflow.

Impact

Attack Chain

1. Attacker identifies Edimax EW-7478APC router accessible via LAN or WAN
2. Crafts HTTP POST request to /goform/formWlSiteSurvey
3. Supplies oversized selSSID parameter value exceeding buffer bounds
4. Stack buffer overflow overwrites return address / function pointers
5. Attacker controls execution flow — arbitrary code executes as root
6. Full device compromise achieved remotely, without authentication

Technical Details

Affected Component

Why the CVSS Score is 9.9

The near-perfect CVSS score reflects several compounding risk factors:

• No authentication required: The vulnerable endpoint does not enforce authentication, making any network-reachable device exploitable without credentials.
• Network-exploitable: The attack can be executed entirely over HTTP — no physical access required.
• Low complexity: The overflow is straightforward to trigger; no race conditions or complex preconditions apply.
• Scope change: Exploitation may affect resources beyond the vulnerable component itself, including connected network segments.
• Public exploit: A working proof-of-concept has been publicly disclosed, dramatically lowering the barrier to exploitation.

Exploitation Vector

The /goform/formWlSiteSurvey handler is part of the router's wireless site survey feature — a common function in consumer and SOHO routers for scanning nearby wireless networks. Because this endpoint is reachable from the local network interface (and potentially the WAN admin interface if remote management is enabled), the attack surface is broad.

Affected Devices

At the time of publication, no patched firmware version has been released by Edimax. Users should monitor the Edimax support portal for firmware updates.

Immediate Mitigation Steps

Until an official firmware patch is available, implement the following mitigations:

1. Disable Remote Management

If remote (WAN-side) administration is enabled, disable it immediately:

• Log into your router admin panel (typically http://192.168.0.1)
• Navigate to Advanced Settings → Remote Management
• Disable remote administration access
• Save and reboot

2. Restrict LAN Access to the Admin Interface

Limit which devices can access the router's admin panel:

# If your router supports ACL rules, restrict admin access to known management IPs
# Example: Allow only 192.168.1.100 to access the admin interface

3. Place the Router Behind a Firewall

Ensure the Edimax EW-7478APC is not directly reachable from the internet. Deploy it behind a perimeter firewall and verify:

# Verify no external ports pointing to the router admin interface
# Check for port forwarding rules to 192.168.x.x:80 or :443
nmap -sV your-public-ip -p 80,443,8080,8443

4. Network Segmentation

If this router is used in a business or multi-zone environment, isolate it from critical assets:

• Place the router on a dedicated VLAN
• Use firewall rules to prevent lateral movement from the router's network segment
• Monitor for unusual traffic from the router's IP

5. Monitor for Exploitation Indicators

Watch for signs of exploitation on connected networks:

Indicators of Compromise (IoC):
- Unexpected HTTP POST requests to /goform/formWlSiteSurvey
- Unusual outbound connections from the router's IP
- Unexplained configuration changes on the router
- New admin credentials or SSH keys appearing
- DNS hijacking — unexpected DNS resolution results

Detection

IDS/IPS Signature

alert http any any -> any any (
  msg:"CVE-2026-19961 Edimax EW-7478APC selSSID Buffer Overflow";
  flow:to_server,established;
  http.method; content:"POST";
  http.uri; content:"/goform/formWlSiteSurvey";
  http.request_body; content:"selSSID=";
  byte_test:0,>,256,0,relative,string;
  sid:2026199610;
  rev:1;
)

Log Monitoring

If your router logs to a syslog server, watch for:

# Splunk — detect large POST requests to the vulnerable endpoint
index=network_logs uri_path="/goform/formWlSiteSurvey"
| where request_body_length > 256
| stats count by src_ip, dest_ip
| where count > 2

Background: Buffer Overflows in SOHO Router Firmware

Buffer overflow vulnerabilities in SOHO router firmware are unfortunately common. Consumer-grade routers often run stripped-down Linux environments with older C codebases that lack modern exploit mitigations such as stack canaries, ASLR, or non-executable stacks. This makes successful exploitation reliable once a vulnerability is found.

The EW-7478APC appears to be an 802.11ac dual-band access point/router popular in small office and home office environments. Its use in business settings — where it may sit at the network perimeter — amplifies the risk of this vulnerability.

Remediation Summary

References

• NVD — CVE-2026-19961
• Edimax Support Portal
• CWE-121: Stack-based Buffer Overflow