This vulnerability involves improper neutralization of special elements in OS commands (CWE-78) in the Edimax EW-7438RPn Mini firmware (version 1.13 and prior). The /goform/formSysCmd endpoint exposes a system command interface via the sysCmd parameter. A remote attacker with authentication can submit arbitrary shell commands, resulting in root-level command execution. The vulnerability was publicly disclosed in June 2025 with a critical CVSS 4.0 score of 9.4. Evidence of exploitation was observed in September 2024. No patch or official remediation guidance has been provided by the vendor as of the published date.

Successful exploitation allows a remote authenticated attacker to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This can affect the confidentiality, integrity, and availability of the device and any network it is connected to. The vulnerability is critical due to the high privileges gained and ease of exploitation (low attack complexity, no user interaction required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface to trusted users only and monitor for suspicious activity. Since exploitation requires authentication, ensure strong credentials and consider disabling remote management if not needed.