This vulnerability involves an OS command injection in the Edimax EW-7438RPn router firmware (versions up to 1.31). Specifically, the formWpsStart function in the /goform/formWpsStart file improperly handles the pinCode parameter, enabling remote attackers to inject and execute arbitrary operating system commands. The weakness allows unauthenticated remote exploitation without user interaction. Despite early vendor notification, no response or patch has been provided. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. No official remediation or patch links are available, and the device is not a cloud service, so remediation depends on vendor action.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of exploitation in the wild, but a public exploit exists, increasing the risk of attack. The lack of vendor response and patch availability means affected devices remain vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should consider mitigating exposure by limiting network access to the affected device, disabling WPS if possible, or replacing the device with a secure alternative. Monitor for updates from Edimax for any forthcoming fixes.