Edimax EW-7438RPn webs formWizSurvey os command injection

Vulnerability

The vulnerability resides in the formWizSurvey function of the webs component in Edimax EW-7438RPn firmware up to version 1.31. The function does not sanitize user-supplied input in the ip, mask, and gateway parameters, allowing an attacker to inject arbitrary OS commands through backticks or other shell metacharacters [1].

Exploitation

An attacker with network access to the device can send a crafted POST request to /goform/formWizSurvey. The exploit requires valid credentials (default credentials admin:1234 are often used) and can be executed remotely without any prior authentication requirement beyond the default login [1]. The PoC demonstrates setting the ip parameter to ` telnetd -l /bin/sh -p 1234 ` to start a telnet shell [1].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands as root on the device. This can lead to full compromise, including data exfiltration, further network attacks, and persistent backdoor access [1].

Mitigation

The vendor was informed but did not respond, and no patch has been released as of the publication date [1]. Users are advised to restrict network access to the device, change default credentials, and consider replacing the device if it remains unpatched.