An OS command injection flaw in the Edimax EW‑7438RPn Mini firmware allows an authenticated attacker to execute arbitrary shell commands as the root user via the mp.asp form handler. The vulnerability stems from improper validation of the "command" parameter sent to the /goform/mp endpoint, enabling injection of shell metacharacters. Successful exploitation would grant full system control, compromising confidentiality, integrity, and availability of the device and any network segments it supports.

The flaw affects the Edimax EW‑7438RPn Mini devices running firmware version 1.13 and earlier. The vendor product is the Edimax EW‑7438RPn Mini wireless range extender.

The CVSS score of 9.4 indicates a critical severity, while an EPSS score of 4% suggests a moderate probability that the vulnerability will be exploited within the next months. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the device, and the attacker must send crafted requests to the /goform/mp endpoint. Because the command is executed with root privileges, a single successful request provides complete control over the system.