This vulnerability affects Edimax EW-7478APC version 1.04. The issue lies in the stainfo function of the /goform/stainfo endpoint, where the interface argument can be manipulated to perform command injection. This allows remote attackers to execute arbitrary commands on the device. The vulnerability has been publicly disclosed, and exploit code is available. The vendor was contacted but has not issued any response or patch. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of device functionality. The medium CVSS score reflects a moderate risk, considering the attack vector is network-based with low attack complexity and no user interaction required.

No official patch or remediation is currently available from the vendor. Users should apply any future updates from Edimax once released. Until then, restricting network access to the device and monitoring for suspicious activity may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.