This vulnerability affects Edimax EW-7478APC version 1.04 in the formiNICbasic function located in /goform/formiNICbasic. An attacker can remotely manipulate the rootAPmac parameter in a POST request to inject OS commands, potentially leading to unauthorized command execution on the device. The vulnerability is confirmed and publicly disclosed, but the vendor has not provided any fix or mitigation guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary operating system commands on the affected device, which could lead to unauthorized control or disruption of the device's operation. The impact is rated medium due to limited impact metrics and the requirement of low privileges.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fixes are published, users should consider restricting network access to the affected device to trusted sources only and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.