CVE-2026-108918: critical vulnerability in Edimax BR-6208AC
Edimax BR-6208AC formWlanMP command injection
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 2.0%
exploitation probability
2.0%top 19% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
Edimax · BR-6208ACpublic PoCs found — 1
cve_referencegithub.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formWlanMPunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Edimax BR-6208AC
In the same product, most dangerous first.
CVE-2025-15257MEDIUMEdimax BR-6208AC Web-based Configuration formRoute command injectionEPSS 5.1%CVE-2025-15256MEDIUMEdimax BR-6208AC Web-based Configuration formStaDrvSetup command injectionEPSS 3.8%CVE-2026-7682MEDIUMEdimax BR-6208AC L2TP Mode setWAN command injectionEPSS 2.4%CVE-2026-108917CRITICALEdimax BR-6208AC formAutoFWupgrade command injectionEPSS 2.0%CVE-2026-108916MEDIUMEdimax BR-6208AC formAccept command injectionEPSS 1.7%CVE-2026-7685HIGHEdimax BR-6208AC setWAN buffer overflowEPSS 0.8%