A command injection flaw exists in the formWizSurvey endpoint of the Edimax EW‑7438RPn router firmware up to 1.31, whereby manipulating the ip/mask/gateway parameters allows execution of arbitrary operating‑system commands. The CVE description states that the vulnerability can be exploited remotely and that the exploit has been publicly disclosed, but does not specify whether authentication is required. We infer that the attack can be performed by any host with access to the web interface, i.e. without prior authentication, and that successful exploitation would give an attacker full control over the device, compromising its confidentiality, integrity, and availability. The weakness corresponds to CWE‑77 (OS Command Injection) and CWE‑78 (Improper Neutralization of Special Elements used in an OS Command).

The flaw affects only the Edimax EW‑7438RPn router, specifically firmware versions 1.31 and earlier. No other hardware or software components are listed as impacted by this vulnerability.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of 3% reflects a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation code has been disclosed publicly, and the vulnerability can be triggered remotely via the router’s web interface, making it accessible to attackers who can reach the device across the network.