This vulnerability affects the Edimax EW-7438RPn device running firmware version 1.28a. The issue resides in the formHwSet function of the POST request handler, specifically in the handling of parameters such as Anntena, Mcs, regDomain, nic0Addr, nic1Addr, wlanAddr, wanAddr, wlanSSID, wlanChan, comd, initgain, txcck, and txofdm. Improper input validation allows an attacker to inject arbitrary commands remotely. The vendor was notified but did not respond, and no official remediation or patch is currently available. The exploit code is publicly accessible, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to unauthorized control or disruption of the router. Given the medium CVSS score, the impact is significant but may require some level of access or conditions to exploit. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting remote access to the device's management interface and monitoring for suspicious activity. Applying network-level controls to limit access to the affected device may reduce risk until a patch is released.