CVE-2026-9343— Edimax EW-7438RPn webs formWpsStart os command injection
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 32
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Edimax | EW-7438RPn | 1.0 | affected |
1.1 | affected | ||
1.2 | affected | ||
1.3 | affected | ||
1.4 | affected | ||
1.5 | affected | ||
1.6 | affected | ||
1.7 | affected | ||
| … +24 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Edimax EW-7438RPn webs formWpsStart os command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Edimax | EW-7438RPn | 1.0 | cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-9343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9343
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-9343 (1)
Same Patch Batch · Edimax · 2026-05-23 · 5 CVEs total
| CVE-2026-9295 | 8.8 HIGH | Edimax BR-6428NS POST Request formWirelessTbl buffer overflow |
| CVE-2026-9294 | 8.8 HIGH | Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow |
| CVE-2026-9297 | 6.3 MEDIUM | Edimax BR-6428NS POST Request formWlbasic command injection |
| CVE-2026-9296 | 6.3 MEDIUM | Edimax BR-6428NS POST Request formWlanM system command injection |
IV. Related Vulnerabilities
Same product: EW-7438RPn
- CVE-2026-9482
Edimax EW-7438RPn formSDHCP stack-based overflow - CVE-2026-9481
Edimax EW-7438RPn formStats stack-based overflow - CVE-2026-9480
Edimax EW-7438RPn formrefresh stack-based overflow - CVE-2026-9479
Edimax EW-7438RPn formLogout stack-based overflow - CVE-2026-9463
Edimax EW-7438RPn formLicence stack-based overflow
Same vendor: Edimax
- CVE-2026-9482
Edimax EW-7438RPn formSDHCP stack-based overflow - CVE-2026-9481
Edimax EW-7438RPn formStats stack-based overflow - CVE-2026-9480
Edimax EW-7438RPn formrefresh stack-based overflow - CVE-2026-9479
Edimax EW-7438RPn formLogout stack-based overflow - CVE-2026-9463
Edimax EW-7438RPn formLicence stack-based overflow
Same weakness: CWE-78
- CVE-2026-40852
Command injection via malicious configuration - CVE-2026-8450
HTTP::Daemon versions before 6.17 for Perl allow OS command - CVE-2026-9207
Command Injection in Connect Allows Privilege Escalation on - CVE-2026-44444
Lumiverse: Spindle extension install runs untrusted lifecycl - CVE-2026-9560
OpenVPN Connect macOS 3.5.1-3.8.1权限提升漏洞
V. Comments for CVE-2026-9343
No comments yet