CVE-2026-108935

A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in Edimax BR-6208AC 1.32 in an unknown function of the file /goform/formFilter. Manipulation leads to cross site scripting. The attack can be executed remotely, and the exploit is publicly available.

A vulnerability in Edimax BR-6208AC router version 1.32 affects unknown code in the file /goform/formAccept. Manipulating the submit-url argument results in command injection. The attack can be carried out remotely, and the exploit has been made public. The vendor was contacted but did not respond, and the product is no longer supported.

A vulnerability was detected in Edimax BR-6208AC up to version 1.02, affecting an unknown function of the file /goform/setWAN. Manipulating the argument pptpDfGateway results in buffer overflow.

A vulnerability was identified in Edimax BR-6208AC 1.32 in an unknown function of the file /goform/formWlanMP. Manipulation of the readE2P argument leads to command injection. The attack can be initiated remotely, and the exploit is publicly available and may be used.

A vulnerability was determined in Edimax BR-6208AC 1.32 affecting some unknown processing of the file /goform/formAutoFWupgrade. Manipulation of the tftpsIP argument can lead to command injection. The attack may be performed remotely, and the exploit has been publicly disclosed and may be utilized.

A vulnerability has been found in Edimax BR-6208AC 1.32 affecting an unknown part of the file /goform/formWlanMP. Manipulation of the ateBW argument leads to a buffer overflow. The attack can be executed remotely, and the exploit has been disclosed to the public and may be used.

A vulnerability was found in Edimax BR-6208AC 1.32 in an unknown function of the file '/goform/formWlSiteSurvey'. Manipulation of the 'ifname' argument causes a buffer overflow that can be exploited remotely. The exploit has been published and may be used; the vendor did not respond and the product is no longer supported.

EDIMAX BR-6208AC router version V2_1.02 is vulnerable to command injection. The pppUserName field is passed directly to the system() function without proper sanitization, allowing an attacker to execute arbitrary code.