This vulnerability (CVE-2025-34024) affects Edimax EW-7438RPn Mini routers running firmware version 1.13 or earlier. It is an OS command injection flaw (CWE-78) in the mp.asp form handler at the /goform/mp endpoint. The endpoint fails to properly neutralize special shell characters in the command parameter, allowing an authenticated attacker to execute arbitrary shell commands as root. The vulnerability has a CVSS 4.0 base score of 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. Exploitation evidence was reported by Shadowserver Foundation on 2024-09-14 UTC. No patch or vendor advisory is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full compromise of the router, including potential control over network traffic, device configuration, and persistent access. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability of the device and network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device management interface to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. No official patch or workaround has been published by Edimax at this time.