This vulnerability involves command injection in the Edimax EW-7438RPn firmware version 1.12. The issue resides in the /goform/formConnectionSetting endpoint, where improper handling of the max_Conn/timeOut parameter allows an attacker to inject arbitrary commands. The vulnerability can be exploited remotely without requiring user interaction or elevated privileges. The vendor was notified but has not provided a response or patch. No official remediation or mitigation guidance is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected device remotely. This may lead to unauthorized control or disruption of the device's operation. The CVSS score of 5.3 indicates a medium impact level. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider limiting network exposure of the affected device and monitor for unusual activity. Avoid exposing the device's management interface to untrusted networks until a fix is released.