CVE-2025-34029

The vulnerability exists in the handling of the syscmd.asp form, available at the /goform/formSysCmd endpoint. The sysCmd parameter accepts user input without proper validation and sanitization, allowing arbitrary system shell commands to be passed directly. An authenticated attacker can submit a crafted HTTP request containing malicious commands that will be executed by the device's operating system with the highest privileges (root). The Shadowserver Foundation organization documented evidence of exploitation of this vulnerability on 2024-09-14 UTC.

The attacker gains full control over the device with root privileges, enabling execution of arbitrary system commands, modification of configuration, network traffic interception, and potential use of the device as a starting point for further attacks on the local network.

Security patches available from the manufacturer should be applied according to the references. If an update is not available or cannot be deployed immediately, it is recommended to restrict access to the device's administrative panel to trusted IP addresses only and isolate the device from critical network segments.

Edimax EW-7438RPn Mini — firmware version 1.13 and all earlier versions.