CVE-2026-108916: medium-severity vulnerability in Edimax BR-6208AC
Edimax BR-6208AC formAccept command injection
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 1.7%
exploitation probability
1.7%top 24% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Affected products
Edimax · BR-6208ACpublic PoCs found — 1
cve_referencegithub.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formAcceptunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Edimax BR-6208AC
In the same product, most dangerous first.
CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2025-15256MEDIUMEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injectionEPSS 3.8%CVE-2026-7682MEDIUMEdimax BR-6208AC L2TP Mode setWAN command injectionEPSS 2.4%CVE-2026-108918CRITICALEdimax BR-6208AC formWlanMP command injectionEPSS 2.0%CVE-2026-108917CRITICALEdimax BR-6208AC formAutoFWupgrade command injectionEPSS 2.0%CVE-2026-7685HIGHEdimax BR-6208AC setWAN buffer overflowEPSS 0.8%