This vulnerability exists in Edimax EW-7478APC version 1.04 within the formStaDrvSetup function of the /goform/formStaDrvSetup component. An attacker can remotely exploit the OS command injection by manipulating the rootAPmac parameter in a POST request. The vulnerability allows execution of arbitrary OS commands with limited privileges. The vendor was contacted but did not respond, and no official fix or remediation level has been published. The CVSS 4.0 base score is 5.3, reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impact.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device with limited privileges. This can lead to unauthorized control or disruption of device functionality. The impact is limited by the low privileges of the exploited context and the absence of confirmed exploits in the wild.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider restricting network access to the affected device, especially from untrusted networks, to reduce exposure. Monitor for any future vendor advisories or updates regarding this vulnerability.