Edimax BR-6208AC 1.32 Has Critical Remote Code Injection Flaw
A critical vulnerability in Edimax BR-6208AC firmware allows remote attackers to inject commands via a file upgrade form.
Key points
- CVE-2026-108917 allows remote command injection in Edimax BR-6208AC 1.32.
- The flaw involves manipulating the tftpsIP argument in /goform/formAutoFWupgrade.
- The vendor did not respond to early contact regarding this public disclosure.
A critical remote code execution vulnerability exists in Edimax BR-6208AC firmware version 1.32, according to a National Vulnerability Database record. The flaw, identified as CVE-2026-108917, allows attackers to inject commands from a remote location.
At a glance
- CVE
- CVE-2026-108917
- Product
- Edimax BR-6208AC
- CVSS
- 10 Critical
- Weakness
- command injection
- Exploited
- No known exploitation
The vulnerability stems from improper processing of the /goform/formAutoFWupgrade file. By manipulating the tftpsIP argument, an attacker can execute arbitrary commands on the device. The National Vulnerability Database assigns this issue a CVSS score of 10, rating it as critical severity.
Context and Background
The weakness is classified under CWE-77, which covers improper neutralization of special elements used in an OS command, and CWE-74, which addresses improper neutralization of input during data transmission. These categories indicate that the application fails to adequately sanitize user-supplied input before passing it to the operating system.
The exploit method has been publicly disclosed, meaning the technical details are available for potential misuse. The National Vulnerability Database notes that the exploit may be utilized by threat actors. This public availability increases the risk of automated scanning and targeted attacks against vulnerable devices.
The vendor was contacted early in the disclosure process about this specific vulnerability. However, the maintainer did not respond in any way to these initial outreach attempts. This lack of communication has left users without official guidance or a confirmed timeline for remediation from the manufacturer.
Who Is Affected
This vulnerability specifically affects Edimax BR-6208AC devices running firmware version 1.32. The National Vulnerability Database explicitly states that this vulnerability only affects products that are no longer supported by the maintainer. This indicates that Edimax has ended its support lifecycle for this particular hardware model.
What should you do?
Since the vendor has not responded and the product is unsupported, no fix has been confirmed yet. Users relying on this hardware for network connectivity face significant exposure to remote attacks. Immediate action is required to mitigate the risk of unauthorized command execution on these devices.
What to do and how to stay safe: Edimax
- Verify if your Edimax BR-6208AC is running firmware version 1.32 and isolate it from the internet if it is.
- Replace unsupported hardware with a currently supported model that receives regular security updates.
- Monitor network traffic for unusual outbound connections that may indicate remote command execution.
- Consult with your organization's IT security team to assess the risk of keeping unsupported devices on the network.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-108917?
It is a critical remote code execution vulnerability in Edimax BR-6208AC firmware 1.32 that allows command injection via the tftpsIP argument.
Is there a patch available for this vulnerability?
No, the vendor did not respond to contact, and the product is no longer supported, so no fix has been confirmed.
What is the CVSS score for this flaw?
The National Vulnerability Database rates CVE-2026-108917 with a CVSS score of 10, which is classified as critical.
