The vulnerability resides in the formiNICbasic function of the /goform/formiNICbasic handler on the Edimax EW‑7478APC. manipulates the rootAPmac argument, an attacker can inject operating‑system commands into the router’s firmware. This flaw allows arbitrary commands to be executed from a remote host, giving full control over the device. The weakness is an OS command injection, reflected by CWE‑77 and CWE‑78, and the CVSS score of 5.3 places it in the medium severity range.

Edimax model EW‑7478APC running firmware 1.04 is affected. No other models or firmware versions are listed in the advisory.

The CVSS score of 5.3 indicates a medium risk level, and the exploit is publicly available. The EPSS score of 1% indicates a very low exploitation probability. The absence from the CISA KEV catalog and the low EPSS suggest that exploitation is not yet widespread, but the remote nature of the attack and the ability to execute arbitrary commands mean that the risk to a compromised network could be significant if the device is exposed to untrusted traffic.