High severity · published Jun 20, 2025
CVE-2025-34024
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler
8.8
CVSS
3.9%
EPSS
No
On KEV
Description
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Ew-7438rpn Mini Firmware · Edimax
through 1.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34024
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34024
Exploit
https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injections
Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163
Product
https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
Exploit
https://www.exploit-db.com/exploits/48377
More from Ew-7438rpn Mini Firmware
9.8
CVE-2020-37125
Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution
8.8
CVE-2020-37149
Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution
8.8
CVE-2025-34029
An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler
8.8
CVE-2016-10863
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure
7.5
CVE-2020-37150
Edimax Technology EW-7438RPn-v3 Mini 1.27 - Unauthorized Access: Wi-Fi Password Disclosure