This vulnerability affects Edimax EW-7478APC firmware version 1.04. The setWAN function in the /goform/setWAN endpoint improperly handles input parameters pppUserName, pptpUserName, and L2TPUserName, allowing an attacker to inject arbitrary commands. Remote exploitation is possible without user interaction and with low attack complexity. The vendor has not provided a fix or advisory. Exploit code has been published, but no known exploits in the wild have been reported.

Successful exploitation can allow an attacker to execute arbitrary commands on the affected device remotely, potentially compromising the device's integrity and confidentiality. The medium CVSS score reflects limited impact or exploitability factors such as low privileges required and partial impact on confidentiality, integrity, and availability.

No official fix or patch is currently available from the vendor. Since the vendor did not respond to disclosure, users should consider mitigating exposure by restricting remote access to the affected device, disabling WAN management interfaces if possible, or replacing the device with a non-vulnerable alternative. Monitor vendor channels for any future updates or patches.