CVE-2026-108917: Edimax BR-6208AC formAutoFWupgrade command injection
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Edimax BR-6208AC devices running version 1.32 are identified as affected. The vulnerable endpoint is remotely reachable, and exploitation requires no privileges or user interaction according to the supplied severity vector.
What does an attacker need to exploit this issue?
An attacker needs the ability to send a crafted request to /goform/formAutoFWupgrade and manipulate the tftpsIP argument. The issue is command injection, so successful exploitation can result in execution of attacker-controlled commands.
Is there a vendor-supported fix available?
The affected products are no longer supported by the maintainer. The vendor was contacted about the disclosure but did not respond, and no patch or supported remediation is provided in the available data.
What can be done when patching is not possible?
Reduce exposure by preventing untrusted remote access to the device's web interface and specifically to /goform/formAutoFWupgrade. Because the device is unsupported and public exploit information is available, replacement with a supported product should be considered.