CVE-2026-9343— Edimax EW-7438RPn webs formWpsStart os command injection
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 32
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Edimax | EW-7438RPn | 1.0 | affected |
1.1 | affected | ||
1.2 | affected | ||
1.3 | affected | ||
1.4 | affected | ||
1.5 | affected | ||
1.6 | affected | ||
1.7 | affected | ||
| … +24 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Edimax EW-7438RPn webs formWpsStart os command injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A weakness has been identified in Edimax EW-7438RPn up to 1.31. The affected element is the function formWpsStart of the file /goform/formWpsStart of the component webs. This manipulation of the argument pinCode causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Edimax | EW-7438RPn | 1.0 | cpe:2.3:a:edimax:ew-7438rpn:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-9343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9343
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-9343 (1)
Same Patch Batch · Edimax · 2026-05-23 · 5 CVEs total
| CVE-2026-9295 | 8.8 HIGH | Edimax BR-6428NS POST Request formWirelessTbl buffer overflow |
| CVE-2026-9294 | 8.8 HIGH | Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow |
| CVE-2026-9297 | 6.3 MEDIUM | Edimax BR-6428NS POST Request formWlbasic command injection |
| CVE-2026-9296 | 6.3 MEDIUM | Edimax BR-6428NS POST Request formWlanM system command injection |
IV. Related Vulnerabilities
Same product: EW-7438RPn
- CVE-2026-9482
Edimax EW-7438RPn formSDHCP stack-based overflow - CVE-2026-9481
Edimax EW-7438RPn formStats stack-based overflow - CVE-2026-9480
Edimax EW-7438RPn formrefresh stack-based overflow - CVE-2026-9479
Edimax EW-7438RPn formLogout stack-based overflow - CVE-2026-9463
Edimax EW-7438RPn formLicence stack-based overflow
Same vendor: Edimax
- CVE-2026-9482
Edimax EW-7438RPn formSDHCP stack-based overflow - CVE-2026-9481
Edimax EW-7438RPn formStats stack-based overflow - CVE-2026-9480
Edimax EW-7438RPn formrefresh stack-based overflow - CVE-2026-9479
Edimax EW-7438RPn formLogout stack-based overflow - CVE-2026-9463
Edimax EW-7438RPn formLicence stack-based overflow
Same weakness: CWE-78
- CVE-2026-45136
claude-code-cache-fix: Local code execution via Python tripl - CVE-2026-44712
pam_usb: Shell injection via device UUID and username in pam - CVE-2026-44709
pam_usb: PINENTRY_FALLBACK_APP environment variable allows a - CVE-2026-44713
pam_usb: Command injection via $TMUX environment variable le - CVE-2026-44724
systeminformation: Linux command injection in networkInterfa
V. Comments for CVE-2026-9343
No comments yet