This vulnerability in Edimax EW-7478APC 1.04 involves the formStaDrvSetup function located at /goform/formStaDrvSetup. An attacker can remotely manipulate the rootAPmac parameter in a POST request to inject OS commands, potentially leading to unauthorized command execution on the device. The vulnerability is publicly disclosed with exploit code available, but the vendor has not issued any patch or advisory. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially compromising device integrity and confidentiality. The medium CVSS score reflects moderate impact with limited privileges required and no user interaction. Since the exploit is public, the risk of exploitation may increase, but no known exploits in the wild are reported.

No official patch or remediation is currently available from the vendor. Users should monitor for vendor advisories for any future fixes. Until a patch is released, restricting network access to the device and disabling remote management features may reduce exposure. Due to lack of vendor response, consider device replacement or additional network-level protections if feasible.