PT-2025-26460 · Edimax · Edimax Ew-7438Rpn

Besim Altinok

·

Publicado

2020-04-23

·

Atualizado

2025-11-20

·

CVE-2025-34024

CVSS v4.0

9.4

Crítica

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions: Edimax EW-7438RPn versions 1.13 and prior
Description: An OS command injection issue exists, allowing an authenticated attacker to inject shell commands and achieve arbitrary command execution as the root user. This is due to the improper handling of user-supplied input to the command parameter in the "/goform/mp" endpoint.
Recommendations: For Edimax EW-7438RPn versions 1.13 and prior, as a temporary workaround, consider restricting access to the "/goform/mp" endpoint until a patch is available. Avoid using the command parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-78CWE-20

Identificadores relacionados

BDU:2025-07627
CVE-2025-34024

Produtos afetados

Edimax Ew-7438Rpn