Edimax EW-7438RPn EUVD-2026-31628

The CVSS 4.0 vector specifies PR:L (low privileges required), meaning the attacker must first authenticate to the device web management interface with at least a low-privileged account. Default or weak credentials on consumer IoT devices such as this frequently satisfy this requirement with minimal effort. The attack targets the /goform/formWlanMP endpoint via HTTP POST, so the device's web interface must be network-accessible from the attacker's position (AV:N, LAN or exposed WAN interface). No user interaction is required beyond the attacker's own request. What limits exploitation: authentication is required per CVSS PR:L - unauthenticated exploitation is not supported by the available vector data; the management interface must be reachable (blocked if firewall rules restrict port 80/443 access). The 'formWlanMP' endpoint appears to implement manufacturing/ATE test functionality, but no data confirms it requires a special firmware mode to be active - it appears accessible in normal production firmware operation based on the researcher's disclosure.

This vulnerability presents a notable discrepancy between its CVSS 4.0 score (2.1) and its actual operational severity. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N reflects low-complexity network exploitation with no user interaction and only low privileges required - these are meaningful risk drivers. However, the impact metrics VC:L/VI:L/VA:L with SC:N/SI:N/SA:N suppress the score substantially, producing the anomalously low 2.1 result. For an OS command injection on an embedded Linux router with a public PoC, practitioners should treat CVSS 2.1 as a scoring artifact rather than an accurate risk signal. In reality, arbitrary command execution on an embedded Linux device grants full device compromise: persistent access, LAN pivoting, traffic interception, and credential harvesting. The E:P threat metric (PoC exploit) in the CVSS 4.0 vector confirms the public exploit is factored in. EPSS at 0.84% (75th percentile) indicates moderate exploitation probability relative to all CVEs, consistent with IoT targeting. The device is not in CISA KEV, suggesting opportunistic rather than campaign-level exploitation so far. The vendor's non-response to disclosure and absence of any patch significantly amplify residual risk for deployed units. The CVSS score of 2.1 vs. the practical impact of full router compromise is a confirmed conflict - defenders should not rely on CVSS alone here.

An authenticated attacker - or an insider on the local network who has obtained the router's default or weak credentials - submits a crafted HTTP POST request to http://[device-ip]/goform/formWlanMP, injecting an OS command such as a reverse shell payload into a parameter like ateFunc. The device's CGI handler passes the unsanitized value to a system() or similar call, executing the injected command as root on the embedded Linux firmware. The public PoC on GitHub provides the exact request structure needed, lowering the barrier to exploitation significantly.