CVE-2026-13561 | A vulnerability was detected in Edimax EW-7478APC 1.04. The … | CVSS 6.3 MEDIUM

Description

A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metadata

CVE ID: CVE-2026-13561
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-06-28 16:12 UTC
Published: 2026-06-29 11:00 UTC
Last updated: 2026-06-29 12:48 UTC
Primary CWE: CWE-78
OS Command Injection
Vendor / Product: Edimax / EW-7478APC
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Edimax	EW-7478APC	—	1.04

Weakness (CWE)

CWE	Source	Description
CWE-77	cna	Command Injection
CWE-78	cna	OS Command Injection

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (5)

VDB-374569 | Edimax EW-7478APC POST Request formiNICbasic os command injection https://vuldb.com/vuln/374569
VDB-374569 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/374569/cti
CVE-2026-13561 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-13561
Submit #844111 | EDIMAX EW-7478APC EW-7478APC 1.04 OS Command Injection https://vuldb.com/submit/844111
https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formiNICbasic-34b53a41781f8052bc69c85481124dff