Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2020-37149 is a medium-severity CSRF (CWE-352) vulnerability in Edimax Ew-7438Rpn Mini Firmware. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-11 (Re-authentication) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2020-37149 is a cross-site request forgery (CSRF) vulnerability, classified under CWE-352, affecting the Edimax EW-7438RPn-v3 Mini firmware version 1.27. It enables arbitrary command execution when an authenticated user is tricked into submitting a crafted form to the /goform/mp endpoint. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating high severity due to network accessibility, low complexity, and significant impacts on integrity and availability.
An unauthenticated attacker can exploit this vulnerability remotely by luring an authenticated user to interact with a malicious webpage or link that automatically submits a forged POST request to the device's /goform/mp endpoint. This user interaction requirement (UI:R) allows the attacker, who needs no privileges (PR:N), to achieve arbitrary command execution on the device with the privileges of the tricked user, potentially compromising the Wi-Fi range extender's functionality.
Advisories and related resources include the Edimax product page at https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/48318, and a VulnCheck advisory at https://www.vulncheck.com/advisories/edimax-technology-ew-rpn-mini-cross-site-request-forgery-csrf-to-command-execution detailing the CSRF-to-command-execution attack chain. Practitioners should review these for mitigation guidance, such as firmware updates if available.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-31040
Vulnerability Data
Edimax EW-7438RPn-v3 Mini 1.27 is vulnerable to cross-site request forgery (CSRF) that can lead to command execution. An attacker can trick an authenticated user into submitting a crafted form to the /goform/mp endpoint, resulting in arbitrary command execution on the…
more
device with the user's privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in network device web UI directly enables remote arbitrary command execution on firmware (public-facing app exploitation + network device CLI).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms like anti-CSRF tokens to protect session authenticity, directly preventing forged requests to the /goform/mp endpoint from tricked authenticated users.
SI-10 mandates validation of information inputs such as crafted form data to the vulnerable endpoint, blocking arbitrary command execution.
IA-11 enforces re-authentication for high-risk actions like command execution, stopping CSRF exploits that leverage existing user sessions without further verification.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.