CVE-2026-19960: EW-7478APC command injection

CISO Take

CVE-2026-19960 is a command injection vulnerability in the formWlbasic function of Edimax EW-7478APC wireless access point firmware 1.04, triggered by unsanitized input in the rootAPmac parameter and exploitable remotely by a low-privileged user (CVSS 7.4). This is consumer/SOHO network hardware, not an AI/ML framework, model server, or agent tool — its classification under the ai_tool category appears to be a taxonomy artifact rather than a genuine AI/ML security signal, so CISOs running AI/ML pipelines should not expect direct exposure through their AI stack. The vendor was notified early and did not respond, and while the description states a public exploit has been disclosed, no EPSS score, CISA KEV listing, or Nuclei template currently corroborates active mass exploitation. Risk is real for anyone running this specific access point — especially if it sits near edge IoT/AI camera deployments — given the vendor's silence means no patch is coming. Recommended action: inventory for EW-7478APC devices, lock down the admin interface to trusted management segments, and plan replacement rather than remediation.

Sources:NVDCISA KEVEPSSvuldb.com

What is the risk?

Locally exploitable over the network (AC:L) but requires low-privileged access (PR:L) to the device's web admin interface; no user interaction needed. CVSS 7.4 (High) reflects a changed scope (S:C) — command injection breaks out of the intended admin function into full device compromise — even though individual C/I/A impacts are rated Low. No EPSS score exists to quantify real-world exploitation probability, and the CVE is not in CISA KEV, so there is no confirmed evidence of active mass exploitation, despite the description noting a public exploit has been disclosed. The vendor's non-response to early disclosure means no official patch is expected, which raises long-tail risk for any exposed device.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege access to the EW-7478APC web admin interface via default/weak credentials or LAN/Wi-Fi presence.

Command Injection

Attacker submits a crafted rootAPmac parameter to /goform/formWlbasic, injecting OS commands executed by the device's web server process.

Impact & Lateral Movement

Attacker gains command execution equivalent to full device control, enabling traffic interception, persistence, or pivoting to other devices on the served network segment.

Initial Access

Attacker obtains low-privilege access to the EW-7478APC web admin interface via default/weak credentials or LAN/Wi-Fi presence.

Command Injection

Attacker submits a crafted rootAPmac parameter to /goform/formWlbasic, injecting OS commands executed by the device's web server process.

Impact & Lateral Movement

Attacker gains command execution equivalent to full device control, enabling traffic interception, persistence, or pivoting to other devices on the served network segment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
EW-7478APC	—	—	No patch

Do you use EW-7478APC? You're affected.

How severe is it?

CVSS 3.1

7.4 / 10

EPSS

2.0%

chance of exploitation in 30 days

Higher than 81% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CLow

ILow

ALow

What should I do?

1 step

1) Inventory the network for Edimax EW-7478APC devices running firmware 1.04. 2) Restrict access to the device's web admin interface (/goform/formWlbasic) to trusted management VLANs/IPs only — never expose it to the internet or untrusted LANs. 3) Since the vendor has not responded to disclosure and no patch is confirmed, treat this as an effectively unpatched/EOL risk and plan replacement of affected units. 4) Change default or weak admin credentials to raise the bar for the low-privilege access this exploit requires. 5) Where possible, monitor for anomalous outbound connections or process execution from the AP's management plane.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAPI

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-19960?

CVE-2026-19960 is a command injection vulnerability in the formWlbasic function of Edimax EW-7478APC wireless access point firmware 1.04, triggered by unsanitized input in the rootAPmac parameter and exploitable remotely by a low-privileged user (CVSS 7.4). This is consumer/SOHO network hardware, not an AI/ML framework, model server, or agent tool — its classification under the ai_tool category appears to be a taxonomy artifact rather than a genuine AI/ML security signal, so CISOs running AI/ML pipelines should not expect direct exposure through their AI stack. The vendor was notified early and did not respond, and while the description states a public exploit has been disclosed, no EPSS score, CISA KEV listing, or Nuclei template currently corroborates active mass exploitation. Risk is real for anyone running this specific access point — especially if it sits near edge IoT/AI camera deployments — given the vendor's silence means no patch is coming. Recommended action: inventory for EW-7478APC devices, lock down the admin interface to trusted management segments, and plan replacement rather than remediation.

Is CVE-2026-19960 actively exploited?

No confirmed active exploitation of CVE-2026-19960 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19960?

1) Inventory the network for Edimax EW-7478APC devices running firmware 1.04. 2) Restrict access to the device's web admin interface (/goform/formWlbasic) to trusted management VLANs/IPs only — never expose it to the internet or untrusted LANs. 3) Since the vendor has not responded to disclosure and no patch is confirmed, treat this as an effectively unpatched/EOL risk and plan replacement of affected units. 4) Change default or weak admin credentials to raise the bar for the low-privilege access this exploit requires. 5) Where possible, monitor for anomalous outbound connections or process execution from the AP's management plane.

What systems are affected by CVE-2026-19960?

This vulnerability affects the following AI/ML architecture patterns: Edge/IoT network infrastructure (indirect only — this is router/AP hardware, not a core AI/ML component).

What is the CVSS score for CVE-2026-19960?

CVE-2026-19960 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 1.99%.

What is the AI security impact?

Affected AI Architectures

Edge/IoT network infrastructure (indirect only — this is router/AP hardware, not a core AI/ML component)

What are the technical details?

Original Advisory

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An attacker with low-privilege access to the Edimax EW-7478APC's web management interface (e.g., default/weak admin credentials, or LAN/Wi-Fi access) submits a crafted rootAPmac value to the formWlbasic endpoint. Because the parameter is passed unsanitized into a system-level command, the attacker achieves arbitrary OS command execution with the privileges of the web server process. From there, the attacker can use the compromised AP as a foothold to pivot to other devices on the LAN/WLAN segment it serves — potentially including edge IoT/AI devices such as smart cameras — or to intercept and manipulate network traffic.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component CWE-77Improper Neutralization of Special Elements used in a Command

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.