EUVD-2026-40072
GHSA-7w25-hjpp-83w9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, low-complexity injection, PR:L authentication required; OS command injection yields full C/I/A impact on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in Edimax EW-7478APC 1.04. The impacted element is the function formiNICbasic of the file /goform/formiNICbasic of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in the Edimax EW-7478APC wireless access point (firmware 1.04) allows remote attackers with low-privilege credentials to execute arbitrary operating system commands by manipulating the rootAPmac parameter in a POST request to /goform/formiNICbasic. A public proof-of-concept exploit is available, materially lowering the barrier to exploitation. The vendor did not respond to coordinated disclosure, leaving no official patch path for affected devices.
Technical ContextAI
The EW-7478APC is an Edimax Wi-Fi range extender/access point running an embedded Linux-based firmware. The vulnerable component is the formiNICbasic function within the device's HTTP-based web management interface, exposed at the /goform/formiNICbasic endpoint and reachable via POST request. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause: the rootAPmac argument - a field likely intended to accept a MAC address for root AP configuration - is passed to an OS-level function (such as system() or popen()) without adequate sanitization of shell metacharacters. This class of vulnerability is endemic to embedded consumer and SMB networking firmware, where C-based CGI handlers frequently construct shell commands by string concatenation with user-supplied input. No CPE string was provided in the intelligence data, but the affected product and firmware version (1.04) are identified by VulDB.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was unresponsive to disclosure, and no fix version is confirmed from any reference. As a primary compensating control, administrators should immediately disable remote management on the WAN interface if enabled, restricting access to the web management UI to the local LAN only - this prevents internet-facing exploitation. Additionally, placing the management interface behind a management VLAN or firewall ACL that permits access only from trusted administrator hosts limits lateral exploitation risk. If the device supports disabling the web UI entirely in favor of CLI-only management, that further reduces attack surface. Given the vendor's non-responsiveness and the public availability of exploit code, replacing the EW-7478APC with a supported device from a responsive vendor is the most definitive remediation. Advisory references are available at https://vuldb.com/vuln/374569 and the researcher disclosure at https://lavender-bicycle-a5a.notion.site/EDIMAX-EW-7478APC-formiNICbasic-34b53a41781f8052bc69c85481124dff.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today