CVE-2025-15256mediumCWE-74CWE-77

CVE-2025-15256: medium-severity vulnerability in Edimax BR-6208AC

Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection

Published · Updated

Follow this CVE+ Monitor BR-6208AC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 3.8%
A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web-based Configuration Interface. The manipulation of the argument rootAPmac leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
Edimax · BR-6208AC
Related CVEs — Edimax BR-6208AC

In the same product, most dangerous first.

CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2026-122051CRITICALEdimax BR-6208AC mp command injectionEPSS 2.6%CVE-2026-108918CRITICALEdimax BR-6208AC formWlanMP command injectionEPSS 2.0%CVE-2026-108917CRITICALEdimax BR-6208AC formAutoFWupgrade command injectionEPSS 2.0%CVE-2026-7682MEDIUMEdimax BR-6208AC L2TP Mode setWAN command injectionEPSS 1.9%CVE-2026-108916MEDIUMEdimax BR-6208AC formAccept command injectionEPSS 1.7%