A remote command‑injection flaw exists in the formConnectionSetting endpoint of the EW‑7438RPn router firmware. When the max_Conn or timeOut parameters are manipulated, the device executes the supplied payload as a shell command, allowing an unauthenticated attacker to run arbitrary code on the device. The weakness corresponds to CWE‑74 (user input placed into executable code) and CWE‑77 (input validation failure leading to shell injection).

The affected product is the Edimax EW‑7438RPn router running firmware version 1.12. No additional product variants or version ranges are listed, so only the specified firmware instance is known to be vulnerable.

The CVSS score of 5.3 indicates a medium severity flaw, but the EPSS score is not available, so the current exploitation likelihood is unknown while the vulnerability is known to be exploitable. The exploit has been disclosed publicly and may be used. The device is not included in CISA’s KEV list, suggesting no confirmed widespread exploitation at this time. The attack vector is remote over the HTTP interface, and no authentication is required, making the risk significant for exposed devices. The vendor did not respond to early disclosure, and no patch is currently available.