CVE-2020-37125
Remote Code Execution via Command Injection in Edimax EW-7438RPn-v
Publication date: 2026-02-05
Last updated on: 2026-02-18
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| edimax | ew-7438rpn_mini_firmware | 1.27 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized remote control of the affected device. Attackers can execute arbitrary commands, potentially installing malicious software such as reverse shells to maintain persistent access.
Compromise of the device can lead to exposure of sensitive information like Wi-Fi passwords, which can further jeopardize the security of the entire network the device is connected to.
Additionally, attackers can use this access to launch further attacks within the network, disrupt device functionality, or use the device as a foothold for broader network compromise.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The Edimax EW-7438RPn-v3 Mini device contains a remote code execution vulnerability in its web interface, specifically through the /goform/mp endpoint. This flaw allows unauthenticated attackers to send specially crafted POST requests with command injection payloads, enabling them to execute arbitrary commands on the device.'}, {'type': 'paragraph', 'content': "Attackers can exploit this by injecting shell commands via the 'command' parameter in POST requests, which the device executes. In unconfigured mode, default credentials can be used to gain unauthorized access, and attackers can retrieve sensitive information like Wi-Fi passwords. The vulnerability also allows Cross-Site Request Forgery (CSRF) attacks, where malicious webpages can trigger command execution without user interaction."}, {'type': 'paragraph', 'content': "Overall, this vulnerability arises from insufficient authentication and input validation in the device's web management interface, allowing remote attackers to gain control over the device."}] [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending crafted POST requests to the vulnerable device's /goform/mp endpoint and observing if arbitrary commands can be executed."}, {'type': 'paragraph', 'content': 'A practical detection method is to use curl commands to test command injection via the command parameter.'}, {'type': 'list_item', 'content': "Send a POST request with a command injection payload to check for command execution: curl 'http://<RHOST>/goform/mp' --data 'command=|| id'"}, {'type': 'list_item', 'content': "If the device is in unconfigured mode, use HTTP Basic Authentication with default credentials (admin:1234): curl 'http://<RHOST>/goform/mp' -H 'Authorization: Basic YWRtaW46MTIzNA==' --data 'command=|| id'"}, {'type': 'list_item', 'content': "Send a GET request to /wizard_reboot.asp to check if sensitive information like SSID and wireless key is disclosed: curl 'http://<RHOST>/wizard_reboot.asp'"}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "Immediate mitigation steps include restricting access to the device's web management interface and changing default credentials if the device is in unconfigured mode."}, {'type': 'paragraph', 'content': 'Disabling remote management or restricting it to trusted networks can reduce exposure.'}, {'type': 'paragraph', 'content': 'Applying firmware updates from the vendor that address this vulnerability is recommended once available.'}, {'type': 'paragraph', 'content': 'As a temporary measure, monitor network traffic for suspicious POST requests to /goform/mp and block unauthorized access attempts.'}] [1]