CVE-2025-34029
BaseFortify
Publication date: 2025-06-20
Last updated on: 2025-11-20
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| edimax | ew-7438rpn_mini_firmware | to 1.13 (inc) |
| edimax | ew-7438rpn_mini | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an OS command injection flaw in the Edimax EW-7438RPn Mini router firmware version 1.13 and earlier. It exists in the /goform/formSysCmd endpoint, which exposes a system command interface via the sysCmd parameter. A remote attacker who is authenticated can submit arbitrary shell commands that are executed with root privileges on the device, allowing full control over the router. [1, 3]
How can this vulnerability impact me? :
This vulnerability allows a remote authenticated attacker to execute arbitrary commands as the root user on the affected device. This can lead to complete compromise of the router, including unauthorized access, control over network traffic, disruption of network services, and potential use of the device as a foothold for further attacks within the network. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to send authenticated POST requests to the vulnerable endpoints /goform/formSysCmd or /goform/mp with system commands in the parameters sysCmd or command respectively. For example, using curl to send a command like 'ls' to check if arbitrary command execution is possible: curl -X POST -d 'sysCmd=ls' -u admin:yourpassword http://<device-ip>/goform/formSysCmd or curl -X POST -d 'command=ls' -u admin:yourpassword http://<device-ip>/goform/mp If the response or device behavior indicates command execution, the device is vulnerable. Note that valid authentication credentials are required. Monitoring network traffic for suspicious POST requests to these endpoints may also help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Restrict access to the device's web management interface to trusted networks only, such as local LAN or VPN. 2. Change default or weak administrative credentials to strong, unique passwords. 3. Disable remote management if not needed. 4. Monitor and block suspicious POST requests to /goform/formSysCmd and /goform/mp endpoints. 5. Check for and apply any available firmware updates from Edimax that address this vulnerability. 6. If no patch is available, consider replacing the device or isolating it from critical network segments to reduce risk. [1, 3]