An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user.
References
| Link | Resource |
|---|---|
| https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injections | Exploit Third Party Advisory |
| https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163 | Third Party Advisory |
| https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/ | Product |
| https://www.exploit-db.com/exploits/48377 | Exploit VDB Entry |
Configurations
Configuration 1 (hide)
| AND |
|
History
23 Sep 2025, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vulncheck.com/advisories/edimax-ew-7438rpn-command-injections - Exploit, Third Party Advisory | |
| References | () https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=32163 - Third Party Advisory | |
| References | () https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/ - Product | |
| References | () https://www.exploit-db.com/exploits/48377 - Exploit, VDB Entry | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Edimax
Edimax ew-7438rpn Mini Firmware Edimax ew-7438rpn Mini |
|
| CPE | cpe:2.3:h:edimax:ew-7438rpn_mini:-:*:*:*:*:*:*:* cpe:2.3:o:edimax:ew-7438rpn_mini_firmware:*:*:*:*:*:*:*:* |
23 Jun 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-20 19:15
Updated : 2025-09-23 15:34
NVD link : CVE-2025-34029
Mitre link : CVE-2025-34029
CVE.ORG link : CVE-2025-34029
JSON object : View
Products Affected
edimax
- ew-7438rpn_mini_firmware
- ew-7438rpn_mini
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')