This vulnerability in Edimax EW-7438RPn 1.12 allows remote attackers to perform command injection through the formConnectionSetting function by manipulating the max_Conn/timeOut parameter. The flaw resides in the Setting Handler component's /goform/formConnectionSetting endpoint. Exploitation does not require user interaction and can be performed over the network. The vendor was notified but has not provided any fix or advisory. No known exploits are currently reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary commands on the affected device remotely, potentially compromising device integrity and confidentiality. Given the medium CVSS score and lack of privileges required, the impact is moderate but could lead to significant device control if exploited.

No official patch or remediation has been provided by the vendor. Users should monitor vendor communications for updates. Until a fix is available, restricting network access to the affected device and disabling remote management features where possible may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.