An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 23 Sep 2025 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Edimax ew-7438rpn Mini Firmware
CPEs cpe:2.3:h:edimax:ew-7438rpn_mini:-:*:*:*:*:*:*:*
cpe:2.3:o:edimax:ew-7438rpn_mini_firmware:*:*:*:*:*:*:*:*
Vendors & Products Edimax ew-7438rpn Mini Firmware
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Mon, 23 Jun 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 20 Jun 2025 19:00:00 +0000

Type Values Removed Values Added
Description An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user.
Title Edimax EW-7438RPn Mini OS Command Injection
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2025-06-23T20:41:36.630Z

Reserved: 2025-04-15T19:15:22.546Z

Link: CVE-2025-34029

cve-icon Vulnrichment

Updated: 2025-06-23T20:41:23.047Z

cve-icon NVD

Status : Analyzed

Published: 2025-06-20T19:15:37.210

Modified: 2025-09-23T15:34:34.837

Link: CVE-2025-34029

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-06-23T08:20:14Z