Edimax EW-7438RPn Content-Type formWlanMP os command injection

Vulnerability

The vulnerability resides in the formWlanMP function of the /goform/formWlanMP endpoint in Edimax EW-7438RPn firmware version 1.31. The function directly passes user-supplied values from arguments such as ateFunc, ateGain, ateTxCount, ateChan, ateRate, ateMacID, e2pTxPower1 through e2pTxPower7, e2pTx2Power1 through e2pTx2Power7, ateTxFreqOffset, ateMode, ateBW, ateAntenna, e2pTxFreqOffset, e2pTxPwDeltaB, e2pTxPwDeltaG, e2pTxPwDeltaMix, e2pTxPwDeltaN, and readE2P into an OS command without sanitization, enabling command injection [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted HTTP POST request to /goform/formWlanMP. The request includes malicious payloads in any of the listed arguments; for example, setting ateFunc to telnetd -l /bin/sh -p 1234 starts a telnet daemon on the device [1]. No user interaction or special privileges are required beyond network access to the device.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the device with root privileges. This can lead to full compromise of the extender, including data exfiltration, further network attacks, and persistent backdoor access.

Mitigation

As of the publication date, the vendor (Edimax) has not responded to the disclosure and no patch or firmware update has been released [1]. Users should isolate the device from untrusted networks, disable remote management if possible, or consider replacing the device if it remains unpatched.