CVE-2026-108914: critical vulnerability in Edimax BR-6208AC
Edimax BR-6208AC formWlSiteSurvey buffer overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 0.6%
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Edimax · BR-6208ACpublic PoCs found — 1
cve_referencegithub.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/BufferOverflow_formWlSiteSurveyunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Edimax BR-6208AC
In the same product, most dangerous first.
CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2025-15256MEDIUMEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injectionEPSS 3.8%CVE-2026-108918CRITICALEdimax BR-6208AC formWlanMP command injectionEPSS 2.0%CVE-2026-108917CRITICALEdimax BR-6208AC formAutoFWupgrade command injectionEPSS 2.0%CVE-2026-7682MEDIUMEdimax BR-6208AC L2TP Mode setWAN command injectionEPSS 1.9%CVE-2026-108916MEDIUMEdimax BR-6208AC formAccept command injectionEPSS 1.7%