The vulnerability exists in the formStaDrvSetup function of the /goform/formStaDrvSetup endpoint. An attacker can manipulate the rootAPmac field to inject arbitrary operating‑system commands. This results in full remote command execution on the device, providing an attacker with complete control over the router's operating system. The flaw is a classic example of CWE-77 – command injection, and the operating‑system component is also vulnerable to CWE-78.

The affected system is the Edimax EW‑7478APC Wi‑Fi access point, firmware vendors or product versions CNA data. The device is accessible over the network, so anyone with network connectivity can exploit the flaw.

The CVSS score of 5.3 indicates moderate severity, but the flaw is exploitable without authentication from any remote host. EPSS score of 1% indicates a very low probability of exploitation; however, the vulnerability is not listed in the CISA KEV catalog. Because the vendor has not released a patch and the public exploit is exposed networks. The attack vector is a remote POST request to /goform/formStaDrvSetup, meaning an attacker who can reach the device over the network can trigger the injection.