This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) within the Edimax EW-7438RPn Mini firmware (version 1.13 and prior). The /goform/mp endpoint's mp.asp form handler fails to safely handle user-supplied input in the command parameter, allowing an authenticated attacker to inject shell commands. Successful exploitation results in arbitrary command execution as the root user, posing a critical security risk. The vulnerability was publicly disclosed in June 2025 with a CVSS 4.0 base score of 9.4, indicating high severity and exploitability. Exploitation evidence was noted by Shadowserver Foundation in September 2024. No patch or official vendor advisory is currently provided.

An authenticated attacker can execute arbitrary commands on the affected device with root privileges, potentially leading to full system compromise. This can result in unauthorized control over the device, data exposure, or disruption of network operations. The critical CVSS score of 9.4 reflects the high impact and ease of exploitation given low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface to trusted users only and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.