Edimax EW-7438RPn OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Edimax EW-7438RPn range, affecting versions through 1.31. The issue resides in the 'formWizSurvey' function of the 'webs' component, where user-supplied 'ip', 'mask', and 'gateway' arguments are not properly validated. This oversight allows remote attackers to inject and execute arbitrary operating system commands. The vulnerability has been publicly disclosed, and the vendor has not responded to initial reports.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/formWizSurvey' with crafted 'ip', 'mask', and 'gateway' parameters. The 'ip' parameter can be used to inject commands, which the device will execute. For example, injecting a command to start a telnet session can be used to gain shell access on the device.