Executive brief
A security vulnerability exists in the Edimax EW-7438RPn Wi-Fi extender, a device used to increase the range of wireless networks. An attacker can exploit this flaw to take control of the device by executing unauthorized system commands. This could lead to a complete compromise of the device, allowing an attacker to monitor network traffic or disrupt internet connectivity.
Technical details
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.31 within the 'webs' binary. The root cause is the improper neutralization of special elements in the 'formWlanMP' function located at '/goform/formWlanMP'. Multiple parameters, including 'ateFunc', 'ateGain', and 'ateChan', are passed directly to the system shell without sufficient validation. A remote attacker with low privileges (authenticated) can exploit this by sending a crafted POST request containing shell metacharacters (e.g., backticks) to execute arbitrary OS commands. A public proof-of-concept demonstrates using this flaw to start a telnet daemon for remote shell access. No patch is currently available as the vendor did not respond to the disclosure.
Affected products
- Edimax EW-7438RPn 1.31
Timeline
- 2026-05-25: advisory: NVD publication date
- 2026-05-25: disclosed: Public disclosure of the vulnerability and PoC