Vulnerability · Published Feb 5, 2026 · Assigned by VulnCheck
CVE-2020-37125Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution
Critical 9.8
In plain English
A critical-severity OS command injection in EW-7438RPn Mini from EDIMAX Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.0% (higher than 94% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)7.0%top 5.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and execute malicious scripts on the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EDIMAX Technology | EW-7438RPn Mini | 1.27 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-48318 exploit
- Edimax EW-7438RPn Mini Product Page product
- VulnCheck Advisory: Edimax Technology EW-7438RPn-v3 Mini 1.27 - Remote Code Execution third-party-advisory