A critical stack-based buffer overflow vulnerability in Edimax EW-7478APC 1.04 allows remote attackers to achieve arbitrary code execution.

This is a stack-based buffer overflow occurring within the formWanTcpipSetup function, triggered by improper handling of the pppUserName argument. The vulnerability requires low privileges (authenticated) to trigger, as indicated by the CVSS vector.

Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the application, potentially leading to a full system compromise. Given the critical CVSS score of 9.9, this vulnerability poses a severe risk to network integrity and data confidentiality. Failure to remediate could result in unauthorized administrative control over the affected hardware.

Immediate Action: Contact Edimax support or monitor official channels for firmware updates, as the vendor has not provided a patch to date.

Proactive Monitoring: Review device access logs for unusual traffic patterns or malformed requests targeting the web management interface.

Compensating Controls: Restrict access to the device management interface to trusted management subnets or utilize a firewall to block unauthorized access to the affected web component.

Public Exploit Available: No (The provided data indicates no confirmed public weaponized exploit, despite the description mentioning public availability.)

Due to the critical nature of this buffer overflow and the lack of a vendor-supplied patch, immediate network segmentation is required. Ensure the management interface of the Edimax EW-7478APC is not exposed to the public internet and limit access to verified administrative personnel until a firmware update is released.