CVE-2025-34024

The vulnerability affects the form handler mp.asp, accessible through the /goform/mp endpoint. The 'command' parameter passed by the user is not properly validated or filtered, allowing injection of arbitrary shell commands using shell metacharacters (e.g., semicolon, pipe). An authenticated attacker can execute arbitrary code as the root user. Evidence of active exploitation of this vulnerability was recorded by Shadowserver Foundation on September 14, 2024.

An attacker gains full control of the device with root privileges, enabling configuration reading and modification, installation of malicious software, network traffic interception, and use of the device as an entry point to the internal network.

Apply patches available from the manufacturer according to references. It is recommended to check the availability of firmware updates on the Edimax manufacturer's website. As a temporary measure, restrict access to the device management interface only to trusted hosts and consider isolating the device from the rest of the network infrastructure.

Edimax EW-7438RPn Mini with firmware version 1.13 and all earlier versions.