Security readout for executives and security teams
Plain-English summary
Edimax EW-7478APC firmware 1.04 contains a remotely reachable memory-corruption flaw in its WAN configuration handler. A low-privileged authenticated attacker could potentially compromise the device, disrupt service, or affect protected data. Public exploit material increases urgency, although the sources do not confirm attacks in the wild.
Executive priority
Treat as an immediate asset-identification and exposure-reduction priority. Public exploit availability and potential full device impact justify rapid action, especially for externally reachable management interfaces. Escalate replacement decisions where firmware 1.04 remains exposed and no verified vendor remediation exists.
Technical view
The /goform/formWanTcpipSetup handler fails to safely process the pppUserName argument, causing a stack-based buffer overflow in formWanTcpipSetup. The CVSS 3.1 score is 9.9: network-accessible, low complexity, low privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.
Likely exposure
Confirmed scope is Edimax EW-7478APC version 1.04. Risk is greatest where the affected management endpoint is reachable by untrusted networks or accessible through weakly controlled accounts. The bundle does not establish whether other firmware versions or Edimax products are affected.
Exploitation context
Public exploit material is reported, making attempted exploitation more plausible. However, this CVE is not identified as KEV in the bundle, and no cited source establishes active exploitation. Access requires low privileges according to the supplied CVSS vector; it is not documented here as an unauthenticated flaw.
Researcher notes
The report maps to CWE-119 and CWE-121. Evidence identifies the vulnerable handler, parameter, product, and version, but does not confirm a patch, affected-version range beyond 1.04, exploitation in the wild, or the exact consequence achieved by the public exploit. Avoid inferring unauthenticated access from the word remote.
Mitigation direction
- Inventory EW-7478APC devices and identify those running firmware 1.04.
- Restrict the management interface to trusted administrative networks as an interim safeguard.
- Review accounts with management access and remove unnecessary or weakly controlled access.
- Check Edimax guidance for updated firmware or an approved mitigation; none is confirmed in the sources.
- Isolate or replace affected devices if exposure cannot be reduced and no vendor fix is available.
Validation and detection
- Confirm each device model and installed firmware through trusted administrative records or its management interface.
- Verify the affected management endpoint is not exposed to untrusted networks.
- Review access logs for unusual WAN-configuration requests or unexpected administrative activity.
- Confirm only authorized accounts can reach and use the management interface.
- Recheck vendor and CVE sources for remediation or exploitation-status updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-19959 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.16VulDBCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R3.16VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P——VulDBAV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR810VulDBVulnerability scoring details
Base CVSS 4.0 score
9.4CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
9.9CriticalVector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
9CriticalVector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-391136 | Edimax EW-7478APC formWanTcpipSetup stack-based overflowCVE reference, VulDB · vdb-entry, technical-description
- VDB-391136 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-19959 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #872873 | EDIMAX EW-7478APC EW-7478APC 1.04 Buffer OverflowCVE reference, VulDB · third-party-advisory
- https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formWanTcpipSetup-34b53a41781f8047b36bd11dbcaa84dc?source=copy_linkCVE reference, VulDB · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.