This vulnerability affects Edimax EW-7478APC version 1.04. The stainfo function in the /goform/stainfo endpoint improperly handles the 'interface' argument, enabling remote command injection. An attacker can exploit this remotely without user interaction or elevated privileges. Public exploit code has been disclosed, but no official remediation or patch has been provided by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption. However, the CVSS score and vector suggest limited impact on confidentiality, integrity, and availability, indicating the attack may have constrained consequences.

No official fix or patch is currently available from the vendor. Since the vendor has not responded, users should consider isolating affected devices from untrusted networks and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.