The flaw is located in the formAccept function within the /goform/formAccept endpoint of Edimax EW‑7478 By manipulating the submit‑url parameter, an attacker can inject operating‑system commands. Successful exploitation allows arbitrary OS command execution on the device. The description confirms that this vulnerability can be abused remotely via HTTP POST requests and that the exploit has been publicly disclosed.

The only affected product identified is the Edimax EW‑7478APC wireless access point running firmware version 1.04. No other affected versions are listed, and the vendor did not respond to the disclosure.

The CVSS score of 5.3 denotes a moderate impact. The EPSS score is 1%, and the vulnerability is not listed in the CISA KEV catalog, implying date. The attack vector is a web‑based POST request that can be performed remotely, meaning the device can be targeted from any network with access to the vulnerable endpoint. The presence of CWE‑77 and CWE‑78 weaknesses underlines that uncontrolled command execution is possible if the submit‑url argument is not properly sanitized.