High severity · published Jun 20, 2025
CVE-2025-34024
Edimax EW-7438RPn Mini OS Command Injection via mp.asp
8.8
CVSS
3.9%
EPSS
No
On KEV
Description
An OS command injection vulnerability exists in the Edimax EW-7438RPn firmware version 1.13 and prior via the mp.asp form handler. The /goform/mp endpoint improperly handles user-supplied input to the command parameter. An authenticated attacker can inject shell commands using shell metacharacters to achieve arbitrary command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
Edimax EW-7438RPn Mini · Edimax
through 1.13 · source: vendor
EM
Ew-7438rpn Mini Firmware · Edimax
through 1.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34024
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34024
Exploit
https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injections
Third Party Advisory
https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163
Product
https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
Exploit
https://www.exploit-db.com/exploits/48377
More from Edimax EW-7438RPn Mini
8.8
CVE-2025-34029
Edimax EW-7438RPn Mini OS Command Injection via syscmd.asp