An OS command‑injection flaw exists in the Edimax EW‑7438RPn Mini Wi‑Fi range extenders running firmware version 1.13 and older. The syscmd.asp form handler in the /goform/formSysCmd endpoint fails to validate the sysCmd parameter, allowing a remote authenticated attacker to inject arbitrary shell commands. Successful exploitation executes these commands locally with root privileges, giving the attacker full control of the device’s operating system.

Affected devices are the Edimax EW‑7438RPn Mini Wi‑Fi range extenders with firmware 1.13 or earlier. These models are identified in the CNA as Edimax:Edimax EW‑7438RPn Mini. The first evidence of field exploitation was recorded by the Shadowserver Foundation on 2024‑09‑14 UTC.

The CVSS score of 9.4 indicates a critical vulnerability and the EPSS score of 5 % suggests a notable probability of exploitation. The device is not listed in the CISA KEV catalog, but root‑level code execution represents a high‑priority threat. The violation of the input validation indicates an OS command‑injection weakness (CWE‑78). The likely attack vector is through the device’s remote management interface after an authenticated session is established, commonly via default or compromised credentials; thus the vulnerability can be triggered from within the local network or via any remote user who can log in.