CVE Intelligence
Analysis AI-assisted

CVE-2020-37125: Edimax EW-7438RPn Mini Firmware OS Command Injection

CVE-2020-37125 is a critical OS command injection flaw (CWE-78) in Edimax EW-7438RPn Mini firmware version 1.27, reachable without authentication through the /goform/mp endpoint. The CNA scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The record lists no fixed version and no KEV listing, so organizations should prioritize exposure reduction and verify the vendor's current firmware status.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37125 describes an OS command injection weakness (CWE-78) in the firmware of the Edimax EW-7438RPn Mini, version 1.27. According to the record, the flaw can be triggered over the network through the /goform/mp endpoint without authentication.

Impact

  • The CNA rates the issue critical, with a CVSS 3.1 base score of 9.8 and a CVSS 4.0 score of 9.3.
  • The record states that an unauthenticated attacker can run arbitrary commands on the device.
  • Inference: a compromised range extender could be used as a foothold on the local network, which raises the business risk beyond the device itself.

Affected products and versions

  • Edimax EW-7438RPn Mini firmware, version 1.27, is the only affected product and version listed in the record.
  • The record lists no fixed versions. Whether other firmware releases are affected is unknown.

Exploitation status

  • The record does not show this CVE in the CISA KEV catalog, so no confirmed active exploitation is reported in the sources consulted.
  • The record references an Exploit-DB entry tagged as an exploit, which means public exploit material exists. Its existence does not confirm exploitation in the wild.

Remediation and mitigation

  • Check the vendor product page for supported firmware and apply any update the vendor publishes for your hardware revision.
  • If no supported fix exists, plan to retire or replace the device, since the absence of a listed fix does not mean a fix is unavailable, and the record does not confirm one.
  • Disable remote management and keep the administrative interface away from untrusted networks.
  • Place extenders in a segmented network zone and limit which internal hosts can reach them.

Detection guidance

  • Review device and network logs for unexpected requests to the /goform/mp endpoint, especially from sources outside management systems.
  • Watch for unexplained outbound connections or file downloads from the device, configuration changes, or unexpected reboots.
  • Treat any sign of compromise as a reason to isolate the device and rebuild it from trusted firmware.

Limitations of the available information

  • The record lists no fixed version, no EPSS score, and no SSVC data, so their status is unknown.
  • The VulnCheck advisory is tagged as a broken link in the record, so its details could not be verified.
  • Only the CNA-provided CVSS scores appear in the record. No independent scoring source is confirmed.

Frequently asked questions

What is CVE-2020-37125?

It is a critical OS command injection vulnerability (CWE-78) in Edimax EW-7438RPn Mini firmware version 1.27, reachable without authentication through the /goform/mp endpoint.

Is this vulnerability listed as actively exploited?

No. The record shows it is not in the CISA KEV catalog, so no confirmed active exploitation is reported in the sources consulted. The record does reference a public exploit entry.

Is there a fixed firmware version?

The record lists no fixed version. Check the vendor page for updates and, if none exists, consider replacing the device.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.