Vulnerability · Published Jun 20, 2025 · Assigned by VulnCheck

CVE-2025-34024Edimax EW-7438RPn Mini OS Command Injection via mp.asp

Critical 9.4

In plain English

A critical-severity OS command injection in Edimax EW-7438RPn Mini from Edimax. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)3.9%top 9.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.

Affected products (as reported)

Vendor	Product	Versions
Edimax	Edimax EW-7438RPn Mini	0 – through 1.13

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/ product
https://www.exploit-db.com/exploits/48377 third-party-advisory, exploit
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163 third-party-advisory
https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injections third-party-advisory