An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 23 Sep 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Edimax ew-7438rpn Mini Firmware
CPEs cpe:2.3:h:edimax:ew-7438rpn_mini:-:*:*:*:*:*:*:*
cpe:2.3:o:edimax:ew-7438rpn_mini_firmware:*:*:*:*:*:*:*:*
Vendors & Products Edimax ew-7438rpn Mini Firmware
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Mon, 23 Jun 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 20 Jun 2025 19:00:00 +0000

Type Values Removed Values Added
Description An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user.
Title Edimax EW-7438RPn Mini OS Command Injection
Weaknesses CWE-20
CWE-78
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2025-06-23T20:40:00.795Z

Reserved: 2025-04-15T19:15:22.545Z

Link: CVE-2025-34024

cve-icon Vulnrichment

Updated: 2025-06-23T20:39:52.994Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-20T19:15:37.053

Modified: 2025-09-23T15:34:07.843

Link: CVE-2025-34024

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-06-23T08:20:14Z