CVE-2026-108914
CriticalCVSS 9.9Summary
A vulnerability was found in Edimax BR-6208AC 1.32 in an unknown function of the file '/goform/formWlSiteSurvey'. Manipulation of the 'ifname' argument causes a buffer overflow that can be exploited remotely. The exploit has been published and may be used; the vendor did not respond and the product is no longer supported.
Risk Assessment
A remote attacker could exploit the buffer overflow to destabilize the device or potentially achieve code execution. Since the product is no longer supported, the risk remains unpatched and may be used in widespread attacks.
Recommendation
Replace the Edimax BR-6208AC with a vendor-supported model, as no patch will be released. Until replacement, isolate the device on a separate network and restrict access to its management interface.
Other vulnerabilities in Edimax BR-6208AC
See all- CVE-2026-7685High
A vulnerability was detected in Edimax BR-6208AC up to version 1.02, affecting an unknown function of the file /goform/setWAN. Manipulating the argument pptpDfGateway results in buffer overflow.
- CVE-2025-70161Critical
EDIMAX BR-6208AC router version V2_1.02 is vulnerable to command injection. The pppUserName field is passed directly to the system() function without proper sanitization, allowing an attacker to execute arbitrary code.
Original NVD description (English source)
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS