Public exploit targets unpatched buffer overflow in Edimax BR-6208AC router firmware
A critical remote buffer overflow in the Edimax BR-6208AC has a known public exploit, with the vendor failing to respond to early contact.
Key points
- Edimax BR-6208AC firmware version 1.32 contains a critical remote buffer overflow vulnerability.
- The flaw in the /goform/formWlanMP handler allows attackers to manipulate the ateBW argument.
- No fix is available as the vendor did not respond to disclosure and the product is unsupported.
A critical security flaw in the Edimax BR-6208AC wireless router involves a remote buffer overflow vulnerability. The vulnerability, identified as CVE-2026-108915, affects firmware version 1.32 and has a CVSS score of 9.4, rating it as critical severity.
At a glance
- CVE
- CVE-2026-108915
- Product
- Edimax BR-6208AC
- CVSS
- 9.4 Critical
- Weakness
- buffer overflow
- Exploited
- No known exploitation
Attackers can trigger this issue by manipulating the "ateBW" argument within the /goform/formWlanMP form handler. This manipulation leads to a buffer overflow, which is classified under CWE-120 and CWE-119 weaknesses. The National Vulnerability Database records indicate that the exploit has been disclosed to the public and may be used.
Context and Background
The vendor was contacted early regarding this disclosure but did not respond in any way. Because the manufacturer failed to provide a patch or update, no fix has been confirmed yet for this specific vulnerability. The lack of vendor engagement leaves users of this device without an official remediation path.
This vulnerability only affects products that are no longer supported by the maintainer. The Edimax BR-6208AC running version 1.32 is identified as such a product. Consequently, security researchers note that the public availability of the exploit increases the risk for any network still using this hardware.
Who Is Affected
Only users running the Edimax BR-6208AC with firmware version 1.32 are affected by this specific buffer overflow. The vulnerability targets an unknown part of the file /goform/formWlanMP. Any device exposing this form handler to the internet is potentially vulnerable to remote exploitation.
The NVD record lists the affected product specifically as the Edimax BR-6208AC 1.32. Other models or firmware versions are not mentioned in the current advisory. Since the product is no longer supported, users cannot expect future security updates to address this or similar flaws.
What should you do?
Network administrators should immediately identify any Edimax BR-6208AC routers running version 1.32 on their networks. If found, these devices should be isolated from the internet or replaced with supported hardware. Monitoring network traffic for suspicious activity targeting the /goform/formWlanMP endpoint is also recommended.
What to do and how to stay safe: Edimax
- Inventory your network to locate any Edimax BR-6208AC devices running firmware version 1.32.
- Isolate unsupported devices from the public internet to prevent remote exploitation of the buffer overflow.
- Monitor firewall logs for traffic targeting the /goform/formWlanMP form handler or the ateBW argument.
- Plan to replace end-of-life networking hardware with supported models that receive regular security updates.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108915?
The vulnerability has a CVSS score of 9.4, which is rated as critical severity.
Is there a patch available for this Edimax router flaw?
No fix has been confirmed yet, as the vendor did not respond to the disclosure and the product is unsupported.
Which specific firmware version is affected by this buffer overflow?
Only Edimax BR-6208AC firmware version 1.32 is affected by this vulnerability.
