CVE-2026-13561: medium-severity vulnerability in Edimax EW-7478APC
Edimax EW-7478APC POST Request formiNICbasic os command injection
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 2.0%
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Edimax · EW-7478APCpublic PoCs found — 1
cve_referencelavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formiNICbasic-34b53a41781f8052bc69c85481124dffunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Edimax EW-7478APC
In the same product, most dangerous first.
CVE-2026-19963MEDIUMEdimax EW-7478APC stainfo command injectionEPSS 2.0%CVE-2026-19962MEDIUMEdimax EW-7478APC setWAN command injectionEPSS 2.0%CVE-2026-19960MEDIUMEdimax EW-7478APC formWlbasic command injectionEPSS 2.0%CVE-2026-13581MEDIUMEdimax EW-7478APC POST Request formStaDrvSetup os command injectionEPSS 2.0%CVE-2026-13560MEDIUMEdimax EW-7478APC POST Request formAccept os command injectionEPSS 2.0%CVE-2026-19961CRITICALEdimax EW-7478APC formWlSiteSurvey buffer overflowEPSS 0.8%