CVE-2026-13563
Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow
- State
- Published
- Severity
- 8.7 High
- Published
- Jun 29, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 28, 2026
Description
A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| 2.0 | 9.0 High | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
EW-7478APCEdimax |
|
References
- VDB-374571 | Edimax EW-7478APC POST Request formL2TPSetup stack-based overflowvdb-entrytechnical-description
- VDB-374571 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-13563 | CVE Analysis and Reportthird-party-advisory
- Submit #844113 | EDIMAX EW-7478APC EW-7478APC 1.04 Buffer Overflowthird-party-advisory
- https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formL2TPSetup-34b53a41781f80f295f8ca2aa55e1226?pvs=73exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.