EUVD-2026-60004
GHSA-rxq7-6cq4-rm79
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable CGI command injection with low-privilege auth; scope changed as embedded Linux likely runs web process as root.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Command injection in Edimax EW-7478APC wireless access point firmware 1.04 enables remote authenticated attackers to execute arbitrary OS commands by manipulating the interface argument sent to the /goform/stainfo CGI endpoint. A public proof-of-concept exploit has been disclosed (CVSS 4.0 supplemental metric E:P confirmed), the vendor has not responded to disclosure, and no patch exists - leaving the attack surface permanently open absent network-level mitigations. No confirmed active exploitation (not in CISA KEV) at time of analysis, but the public POC lowers the bar for opportunistic targeting.
Technical ContextAI
The Edimax EW-7478APC is a SOHO/SMB wireless access point running embedded Linux firmware version 1.04. Its web management interface exposes CGI endpoints under /goform/, one of which - stainfo - retrieves wireless station information. The root cause is CWE-74 (Injection): the interface parameter passed to the stainfo function is incorporated into a shell or system call without sanitization or escaping, enabling injection of arbitrary OS commands. This pattern is endemic to embedded Linux devices where CGI handlers invoke shell utilities directly. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the endpoint is reachable over the network with low-privilege credentials and no special attack requirements.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. Administrators should immediately restrict access to the device's HTTP/HTTPS management interface by isolating it on a dedicated management VLAN inaccessible from untrusted networks or the internet; this eliminates the network attack surface without device replacement, though it does not fix the underlying flaw. If remote web management is not operationally required, disable it entirely via the device's existing interface controls. Firewall ACLs blocking inbound connections to the device's management port (typically TCP 80/443) from all but explicitly trusted management hosts provide an additional layer. Monitor https://vuldb.com/vuln/391140 for any future vendor patch release. Given the absence of a vendor response, replacement with a supported device should be evaluated for environments where the management interface cannot be fully isolated.
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today