The flaw consists of an OS command injection in the pinCode argument of the formWpsStart function inside the component webs of the Edimax EW-7438RPn router. An attacker who can reach the device over the network can send a crafted request to /goform/formWpsStart and cause the router to execute arbitrary shell commands. This results in full compromise of the device, allowing the attacker to read or modify any data stored on the router, disrupt its network services, or use it as a pivot point for further attacks.

All Edimax EW-7438RPn models with firmware up to and including version 1.31 are affected. The vulnerability is present in the firmware file /goform/formWpsStart and can impact any router that exposes the administrator interface to the attacker's network.

The CVSS score of 5.3 indicates a moderate severity, yet the vulnerability permits remote exploitation without authentication. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog. The attack vector is purely remote, requiring network access to the router. Because the vendor has not released a patch and the exploit is publicly available, the risk of exploitation remains significant for exposed devices.