CVE-2025-34029: edimax edimax ew-7438rpn mini OS Command Injection

Vulnerability summary

CVE-2025-34029 is a critical (CVSS 9.4) OS Command Injection vulnerability in edimax edimax ew-7438rpn mini. EPSS estimates a 3.42% chance of exploitation in the next 30 days, higher than 88.8% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 20-06-2025
   PublishedVulnerability first disclosed.
2. 14-05-2026
   Last modifiedVulnerability information updated.

Description

An OS command injection vulnerability exists in the Edimax EW-7438RPn Mini firmware version 1.13 and prior via the syscmd.asp form handler. The /goform/formSysCmd endpoint exposes a system command interface through the sysCmd parameter. A remote authenticated attacker can submit arbitrary shell commands directly, resulting in command execution as the root user. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-14 UTC.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.