CVE-2026-13560 | A security vulnerability has been detected in Edimax EW-7478… | CVSS 6.3 MEDIUM

Description

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metadata

CVE ID: CVE-2026-13560
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-06-28 16:12 UTC
Published: 2026-06-29 10:45 UTC
Last updated: 2026-06-29 10:45 UTC
Primary CWE: CWE-78
OS Command Injection
Vendor / Product: Edimax / EW-7478APC
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Edimax	EW-7478APC	—	1.04

Weakness (CWE)

CWE	Source	Description
CWE-77	cna	Command Injection
CWE-78	cna	OS Command Injection

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (5)

VDB-374568 | Edimax EW-7478APC POST Request formAccept os command injection https://vuldb.com/vuln/374568
VDB-374568 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/374568/cti
CVE-2026-13560 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-13560
Submit #844110 | EDIMAX EW-7478APC EW-7478APC 1.04 OS Command Injection https://vuldb.com/submit/844110
https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formAccept-34b53a41781f80d29512d2cd2a772554