This vulnerability affects Edimax EW-7478APC version 1.04. The issue lies in the formAccept function within the /goform/formAccept component, which processes POST requests. An attacker can remotely manipulate the submit-url argument to inject OS commands, potentially leading to unauthorized command execution on the device. The vulnerability has been publicly disclosed, but no vendor response or patch has been provided. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, and limited privileges required.

Successful exploitation allows an attacker to execute arbitrary OS commands remotely on the affected device, which could compromise device integrity and confidentiality. The vulnerability requires low attack complexity and no user interaction, but limited privileges are needed. The impact on confidentiality, integrity, and availability is low to limited according to the CVSS vector.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is provided, users should consider mitigating exposure by restricting network access to the device's management interface and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.