CVE-2020-37149

🗓️ 05 Feb 2026 16:13:42Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 7 Views🌐 WEB

Edimax EW-7438RPn-v3 Mini firmware 1.27 is CSRF vulnerable, enabling command execution via /goform/mp.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2020-37149	5 Feb 202616:13	–	attackerkb
CNNVD	Edimax EW-7438RPn-v3 Mini 跨站请求伪造漏洞	5 Feb 202600:00	–	cnnvd
Cvelist	CVE-2020-37149 Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution	5 Feb 202616:13	–	cvelist
EUVD	EUVD-2020-31040	5 Feb 202616:13	–	euvd
NVD	CVE-2020-37149	5 Feb 202617:16	–	nvd
Positive Technologies	PT-2026-6589	5 Feb 202600:00	–	ptsecurity
Vulnrichment	CVE-2020-37149 Edimax Technology EW-7438RPn-v3 Mini 1.27 - Cross-Site Request Forgery (CSRF) to Command Execution	5 Feb 202616:13	–	vulnrichment

NVD

Vulners

CNA

Node

edimax ew-7438rpn_mini_firmwareMatch1.27

AND

edimax ew-7438rpn_miniMatch3

[
  {
    "vendor": "EDIMAX Technology",
    "product": "EW-7438RPn Mini",
    "versions": [
      {
        "version": "1.23",
        "status": "affected"
      },
      {
        "version": "1.27",
        "status": "affected"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/48318
edimax	www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
vulncheck	www.vulncheck.com/advisories/edimax-technology-ew-rpn-mini-cross-site-request-forgery-csrf-to-command-execution

Parameter	Position	Path	Description	CWE
csrf_token	request body	/goform/mp	CSRF leading to arbitrary command execution via crafted form submission to /goform/mp	CWE-352
command	request body	/goform/mp	CSRF leading to arbitrary command execution via crafted form submission to /goform/mp	CWE-352

05 Mar 2026 01:28Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.18.1 - 8.8

CVSS 45.1

EPSS0.00042

SSVC

CWE-352