CVE-2026-13581
A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaD
CVSS
6.3
Medium
EPSS
1.2%
p63
KEV
—
Exploit Today
19
0-100
Published: Jun 29, 2026 · Last modified: Jun 30, 2026 · CWE-77 · CWE-78
1.2%EPSS · 30 days1.2%
2026-06-302026-07-16
A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- lavender-bicycle-a5a.notion.sitehttps://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formStaDrvSetup-34b53a41781f80a5805cfe72d78b76df
- vuldb.comhttps://vuldb.com/cve/CVE-2026-13581
- vuldb.comhttps://vuldb.com/submit/844116
- vuldb.comhttps://vuldb.com/vuln/374587
- vuldb.comhttps://vuldb.com/vuln/374587/cti
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-341978.8 HIG99.9%
KEV—80Apache ActiveMQ Improper Input Validation Vulnerability2dCVE-2024-121210.0 CRI99.9%
KEV—80Progress Kemp LoadMaster OS Command Injection Vulnerability4dCVE-2022-262589.8 CRI99.6%
KEV—80D-Link DIR-820L Remote Code Execution Vulnerability8dCVE-2026-422718.8 HIG99.6%
KEV—80BerriAI LiteLLM Command Injection Vulnerability2dCVE-2021-252988.8 HIG99.5%
KEV—80Nagios XI OS Command Injection8dCVE-2021-252978.8 HIG98.9%
KEV—80Nagios XI OS Command Injection8d