CVE-2026-13581 | A vulnerability was detected in Edimax EW-7478APC 1.04. This… | CVSS 6.3 MEDIUM

Description

A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metadata

CVE ID: CVE-2026-13581
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-06-28 22:29 UTC
Published: 2026-06-29 15:15 UTC
Last updated: 2026-06-29 15:15 UTC
Primary CWE: CWE-78
OS Command Injection
Vendor / Product: Edimax / EW-7478APC
Sources: cve.org · NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Edimax	EW-7478APC	—	1.04

Weakness (CWE)

CWE	Source	Description
CWE-77	cna	Command Injection
CWE-78	cna	OS Command Injection

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.5	N/D	2.0	cna	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
6.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
6.3	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

References (5)

VDB-374587 | Edimax EW-7478APC POST Request formStaDrvSetup os command injection https://vuldb.com/vuln/374587
VDB-374587 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/374587/cti
CVE-2026-13581 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-13581
Submit #844116 | EDIMAX EW-7478APC EW-7478APC 1.04 OS Command Injection https://vuldb.com/submit/844116
https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formStaDrvSetup-34b53a41781f80a5805cfe72d78b76df