CVE-2025-34029 | THREATINT

Description

An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user.

Reserved 2025-04-15 | Published 2025-06-20 | Updated 2025-06-20 | Assigner VulnCheck

CRITICAL: 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status

unaffected

Any version

affected

Credits

Besim Altinok finder

References

www.edimax.com/...i-fi_range_extenders_n300/ew-7438rpn_mini/ product

www.exploit-db.com/exploits/48377 third-party-advisory exploit

www.broadcom.com/...enter/attacksignatures/detail?asid=32163 third-party-advisory

vulncheck.com/...sories/edimax-ew-7438rpn-command-injections third-party-advisory

cve.org (CVE-2025-34029)

nvd.nist.gov (CVE-2025-34029)

Download JSON