CVE-2020-37125
Published: 05 February 2026
Summary
CVE-2020-37125 is a critical-severity OS Command Injection (CWE-78) vulnerability in Edimax Ew-7438Rpn Mini Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by validating and sanitizing inputs to the vulnerable /goform/mp endpoint.
Prohibits unauthenticated access to dangerous endpoints like /goform/mp that allow arbitrary command execution.
Requires identification, reporting, and remediation of the specific command injection flaw in firmware version 1.27.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated OS command injection in a public-facing web endpoint (/goform/mp) on a network device, directly enabling remote code execution via exploitation of a public-facing application.
NVD Description
Edimax EW-7438RPn-v3 Mini 1.27 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands through the /goform/mp endpoint. Attackers can exploit the vulnerability by sending crafted POST requests with command injection payloads to download and execute…
more
malicious scripts on the device.
Deeper analysisAI
CVE-2020-37125 is a remote code execution vulnerability in the Edimax EW-7438RPn-v3 Mini Wi-Fi range extender running firmware version 1.27. The issue stems from OS command injection (CWE-78) in the /goform/mp endpoint, where unauthenticated attackers can send crafted POST requests containing command injection payloads to execute arbitrary commands on the device, including downloading and running malicious scripts.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants attackers high-impact control over confidentiality, integrity, and availability, enabling full remote command execution on the affected device.
Advisories and related resources include the Edimax product page at https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/, an Exploit-DB entry at https://www.exploit-db.com/exploits/48318, and a Vulncheck advisory at https://www.vulncheck.com/advisories/edimax-technology-ew-rpn-mini-remote-code-execution. Practitioners should review these for any patch or mitigation guidance specific to the device firmware.
Details
- CWE(s)