Description

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-17T00:16:27.137Z",
  "pubdate": "2026-08-17T00:16:27.137Z",
  "executiveSummary": "A critical command injection vulnerability has been identified in the Edimax EW-7478APC router running firmware version 1.04. The vulnerability resides within the stainfo function processed by the web administrative interface at the endpoint /goform/stainfo. Specifically, improper input sanitization of the interface argument allows remote attackers to inject and execute arbitrary operating system commands with elevated privileges.\nThis flaw exposes the affected device to remote exploitation over the network without requiring prior authentication. Successful exploitation leads to arbitrary command execution on the underlying operating system, resulting in a complete compromise of confidentiality, integrity, and availability of the affected router. Given that the exploit has been publicly disclosed and the vendor has failed to provide a response or patch, the risk to deployed systems is extremely high.\nThe vulnerability requires no specialized attacker capabilities beyond network connectivity to the management interface of the target router. Attackers can leverage this flaw to establish persistence, pivot into internal networks, or disrupt local network traffic. Organizations utilizing this product are at immediate risk of full device takeover.",
  "technicalDetails": "The vulnerability is classified as an OS Command Injection flaw stemming from insufficient validation and sanitization of user-supplied input. The vulnerable component is the stainfo function implemented within the binary handling requests for the URI path /goform/stainfo on the Edimax EW-7478APC running firmware version 1.04.\nDuring normal operation, the application processes parameters submitted via HTTP requests to retrieve station information. Among these parameters, the interface argument is directly passed to system-level execution routines or shell interpreters without adequate filtering or escaping of shell metacharacters. Consequently, an attacker can supply specially crafted input containing command separators (such as semicolons, pipes, or backticks) appended to the expected interface parameter value.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker crafts an HTTP request targeting the /goform/stainfo endpoint. Second, the attacker injects malicious payload strings into the interface argument parameter. Third, the web server passes the unsanitized input string directly to the underlying operating system shell via the vulnerable stainfo function. Fourth, the operating system executes the injected commands concurrently with or in place of the intended diagnostic routines.\nThe attack vector is network-exposed, allowing exploitation over local or wide-area networks depending on the configuration of the router management interface. The execution context inherits the privileges of the web server process, which typically runs with root or administrative privileges on embedded Linux-based router environments. Post-exploitation impact includes unauthorized modification of system configurations, interception of network traffic, installation of backdoors, and utilization of the compromised device as a pivot point for lateral movement within the internal local area network."
}