Description

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-17T00:16:26.490Z",
  "pubdate": "2026-08-17T00:16:26.490Z",
  "executiveSummary": "A command injection vulnerability has been identified in the Edimax EW-7478APC router running firmware version 1.04. The security flaw resides within the setWAN function processed by the handler located at the /goform/setWAN endpoint.\nBy manipulating specific parameters associated with Wide Area Network (WAN) configurations—namely pppUserName, pptpUserName, and L2TPUserName—an unauthenticated remote attacker can inject arbitrary operating system commands.\nSuccessful exploitation of this vulnerability results in remote code execution with the privilege level of the underlying web server or daemon, potentially granting full system compromise to the malicious actor.\nThe attack vector is remotely exploitable over the network without requiring prior authentication or user interaction.\nPublic exploits for this vulnerability have been published, significantly elevating the associated risk.\nThe vendor was contacted regarding this disclosure but failed to provide any response or official patch, leaving deployed systems exposed unless compensating controls are implemented.",
  "technicalDetails": "The vulnerability stems from improper input validation and sanitation within the binary handling HTTP POST or GET requests to the /goform/setWAN endpoint on the targeted device.\nThe vulnerable component is the setWAN function, which processes WAN connection parameters parsed from incoming HTTP requests.\nSpecifically, arguments such as pppUserName, pptpUserName, and L2TPUserName accept raw user input and subsequently pass it directly into system execution functions (such as system() or popen()) without adequate neutralization of shell metacharacters.\nThe attack flow proceeds as follows: 1. An attacker crafts a malicious HTTP request directed at the /goform/setWAN URI. 2. The request payload embeds shell command injection operators (e.g., semicolons, pipe symbols, or backticks) within the pppUserName, pptpUserName, or L2TPUserName parameters. 3. The web application parses the parameters and concatenates them directly into a system command string. 4. The underlying operating system executes the resulting command string with the privileges of the running web application, enabling arbitrary code execution.\nAffected systems include Edimax EW-7478APC running firmware version 1.04.\nThe attack requires network exposure, specifically access to the device's management or web interface, which may be exposed to the WAN or LAN depending on device configuration.\nAuthentication and privilege requirements are minimal or non-existent, as the endpoint can be targeted remotely by unauthenticated attackers.\nPost-exploitation impact includes full device takeover, modification of network settings, interception of traffic, and potential utilization of the compromised router as a pivot point for further internal network propagation."
}