This vulnerability affects Edimax EW-7478APC firmware version 1.04. It involves a command injection flaw in the setWAN function located in /goform/setWAN. By manipulating the pppUserName, pptpUserName, or L2TPUserName parameters, an attacker can execute arbitrary commands remotely. The vendor was notified but has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impacts on confidentiality, integrity, availability, and security requirements. Exploit code is publicly available, increasing the risk of exploitation despite no current reports of active attacks.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially compromising device integrity and control. This could lead to unauthorized access or manipulation of the device's network functions. However, the impact is rated medium due to limited scope and the requirement of specific parameter manipulation.

No official patch or remediation is currently available from the vendor. Since the vendor did not respond to disclosure and no fix is provided, users should consider mitigating risk by restricting access to the device's management interface from untrusted networks and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.