CVE-2026-13561: EW-7478APC unauth OS command

CISO Take

A public proof-of-concept now exists for an OS command injection in the formiNICbasic handler of Edimax EW-7478APC Wi-Fi extenders, triggered by an unsanitized rootAPmac parameter in a POST request to /goform/formiNICbasic. This is consumer/SOHO network hardware, not an AI/ML component — despite being tagged 'ai_tool' in this feed, there is no evidence linking it to any LLM framework, agent, model-serving stack, or the AI packages this platform tracks, so treat the AI-category tag as a likely misclassification rather than a signal of AI supply-chain risk. The practical severity is capped by EPSS (0.01158, roughly the 37th percentile) and no CISA KEV or SSVC action-required flag, meaning opportunistic exploitation is possible but not confirmed as active; the vendor was notified and did not respond, so no patch exists. If this device model is anywhere in your network (including as an access point behind an AI edge/IoT deployment), the concrete action is to remove it from remote/WAN-facing management, restrict admin interface access to trusted LANs or a management VLAN, and monitor for anomalous POSTs to /goform/formiNICbasic; given no vendor response, budget for replacement rather than a future patch.

Sources: NVD EPSS CISA KEV ATLAS

What is the risk?

CVSS 6.3 (medium) reflects network-exploitable (AV:N), low complexity (AC:L), but requires low-privilege authentication (PR:L) and no user interaction. A public exploit reportedly exists, which raises real-world exploitability above what the EPSS score (0.01158, ~37th percentile) alone suggests, though it remains well below KEV-level urgency and there is no confirmed active exploitation or Nuclei template in our tracking. Importantly, this is embedded router/AP firmware with no demonstrated connection to any AI/ML framework, model, or pipeline — the 'ai_tool' category assigned to this CVE appears to be a data-quality/misclassification issue rather than a genuine AI security finding. Risk to AI/ML deployments specifically should be treated as negligible unless this exact device model is confirmed present in an organization's network infrastructure (e.g., as Wi-Fi/AP hardware near edge AI or IoT gear).

How does the attack unfold?

Initial Access

Attacker reaches the device's exposed web admin interface, either directly on the LAN or via unintended remote/WAN exposure.

AML.T0049

Exploitation

Attacker submits a crafted POST to /goform/formiNICbasic with shell metacharacters in the rootAPmac parameter, triggering OS command injection.

AML.T0050

Impact

Attacker gains arbitrary command execution on the device's firmware, enabling configuration tampering, traffic interception, or use as a pivot point into the local network.

Initial Access

Attacker reaches the device's exposed web admin interface, either directly on the LAN or via unintended remote/WAN exposure.

AML.T0049

Exploitation

Attacker submits a crafted POST to /goform/formiNICbasic with shell metacharacters in the rootAPmac parameter, triggering OS command injection.

AML.T0050

Impact

Attacker gains arbitrary command execution on the device's firmware, enabling configuration tampering, traffic interception, or use as a pivot point into the local network.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
EW-7478APC	—	—	No patch

Do you use EW-7478APC? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

2.0%

chance of exploitation in 30 days

Higher than 80% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

1 step

No vendor patch exists and Edimax did not respond to disclosure, so mitigation is workaround-only: 1) remove any WAN/remote exposure of the device's web admin interface, restricting access to a trusted management VLAN or LAN only; 2) enforce strong, unique credentials for the admin account (PR:L means the attacker needs some level of authenticated access); 3) monitor firewall/reverse-proxy logs for POST requests to /goform/formiNICbasic with anomalous rootAPmac values as a detection signal; 4) if the device cannot be isolated or replaced, treat it as untrusted and place it behind a segmented firewall zone; 5) plan replacement with a supported access point, since an unresponsive vendor implies no future fix.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-13561?

A public proof-of-concept now exists for an OS command injection in the formiNICbasic handler of Edimax EW-7478APC Wi-Fi extenders, triggered by an unsanitized rootAPmac parameter in a POST request to /goform/formiNICbasic. This is consumer/SOHO network hardware, not an AI/ML component — despite being tagged 'ai_tool' in this feed, there is no evidence linking it to any LLM framework, agent, model-serving stack, or the AI packages this platform tracks, so treat the AI-category tag as a likely misclassification rather than a signal of AI supply-chain risk. The practical severity is capped by EPSS (0.01158, roughly the 37th percentile) and no CISA KEV or SSVC action-required flag, meaning opportunistic exploitation is possible but not confirmed as active; the vendor was notified and did not respond, so no patch exists. If this device model is anywhere in your network (including as an access point behind an AI edge/IoT deployment), the concrete action is to remove it from remote/WAN-facing management, restrict admin interface access to trusted LANs or a management VLAN, and monitor for anomalous POSTs to /goform/formiNICbasic; given no vendor response, budget for replacement rather than a future patch.

Is CVE-2026-13561 actively exploited?

No confirmed active exploitation of CVE-2026-13561 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13561?

No vendor patch exists and Edimax did not respond to disclosure, so mitigation is workaround-only: 1) remove any WAN/remote exposure of the device's web admin interface, restricting access to a trusted management VLAN or LAN only; 2) enforce strong, unique credentials for the admin account (PR:L means the attacker needs some level of authenticated access); 3) monitor firewall/reverse-proxy logs for POST requests to /goform/formiNICbasic with anomalous rootAPmac values as a detection signal; 4) if the device cannot be isolated or replaced, treat it as untrusted and place it behind a segmented firewall zone; 5) plan replacement with a supported access point, since an unresponsive vendor implies no future fix.

What is the CVSS score for CVE-2026-13561?

CVE-2026-13561 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 1.99%.

What is the AI security impact?

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

What are the technical details?

Original Advisory

A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An attacker who has obtained low-privilege access to the device's web management interface (e.g., via default/weak credentials, credential reuse, or exposure of the admin panel to the internet) sends a crafted POST request to /goform/formiNICbasic with a malicious rootAPmac parameter containing shell metacharacters. The formiNICbasic handler passes this value unsanitized into an OS command, granting the attacker arbitrary command execution on the device's underlying Linux-based firmware. From there, the attacker could pivot to intercept or manipulate traffic for any downstream systems on the same network segment, including IoT or edge devices, though this requires the device to be network-adjacent to anything of higher value — there is no direct AI/ML data or model exposure inherent to this vulnerability.

Weaknesses (CWE)

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Implementation] If possible, ensure that all external commands called from the program are statically created.

Source: MITRE CWE corpus.