CVE-2025-34024
Edimax EW-7438RPn Mini OS Command Injection via mp.asp
- State
- Published
- Severity
- 9.4 Critical
- Published
- Jun 20, 2025
- Updated
- May 14, 2026
- Reserved
- Apr 15, 2025
Description
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
Edimax EW-7438RPn MiniEdimax |
|
References
- https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/product
- https://www.exploit-db.com/exploits/48377third-party-advisoryexploit
- https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163third-party-advisory
- https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injectionsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.