The Edimax EW-7438RPn router firmware versions up to 1.31 contain an OS command injection vulnerability in the formWpsStart function of the /goform/formWpsStart web component. By manipulating the pinCode parameter, an attacker can inject arbitrary OS commands remotely. The vulnerability requires low privileges and no user interaction, with limited scope and impact. The vendor was notified but has not issued any patch or remediation guidance. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows an attacker to execute arbitrary OS commands on the affected device remotely, potentially leading to unauthorized control or disruption of the router. The vulnerability requires low privileges and no user interaction, increasing its risk. However, the impact is limited by the vulnerability's scope and vector. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider disabling WPS functionality if possible or isolating the device from untrusted networks to reduce exposure. Monitor official Edimax channels for any future updates or patches addressing this issue.