Edimax EW-7438RPn Mini Cross-Site Request Forgery Vulnerability Leading to Remote Code Execution

A cross-site request forgery (CSRF) vulnerability has been identified in the Edimax EW-7438RPn Mini Wi-Fi range extender, specifically in version 1.27. This vulnerability allows an attacker to trick an authenticated user into submitting a crafted form to the '/goform/mp' endpoint. As a result, arbitrary commands can be executed on the device with the user's privileges.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device, executed with the privileges of the user who was tricked into submitting the crafted form.

Reproduction

To reproduce this vulnerability, an attacker must exploit the CSRF flaw by convincing an authenticated user to submit a form that includes a command payload. This form should be directed to the '/goform/mp' endpoint. Once the form is submitted, the command will be executed on the device with the user's privileges.