by Kastro
Paper/Archive/CVE-2025-34024

CVE-2025-34024

Edimax Edimax EW-7438RPn Mini — Edimax EW-7438RPn Mini OS Command Injection via mp.asp

EPSS 4%CVSS 9.4
critical.is priorityof 100
46
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 90.3.903 × 2018.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.

Affected

ProductAffectedFixed inSource
Edimax EW-7438RPn Mini≤ 1.13–CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refedimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_miniexploitexploit-db.com/exploits/48377writeupbroadcom.com/support/security-center/attacksignatures/detail?asid=32163writeupvulncheck.com/advisories/edimax-ew-7438rpn-command-injections