Edimax BR-6208AC CVE-2025-14910

Exploitation requires a valid authenticated FTP user account on the BR-6208AC. The attacker must have network-level access to the FTP service port (TCP 21, typically only accessible from the LAN in default configurations). The FTP service must be enabled in the device's web administration panel; it is not enabled by default on all firmware versions but is present in version 1.02. The vulnerability does not require any special or non-standard configuration - it is present whenever FTP is active and an attacker holds valid FTP credentials. Exploitation is limited by the fact that FTP is an authenticated service, meaning casual remote internet attackers cannot exploit this without first compromising credentials; local network attackers (or those with valid FTP accounts) can exploit it. The vulnerability grants read-only filesystem access; it cannot be leveraged for code execution, privilege escalation, or writing files.

Risk assessment is constrained by the product's end-of-life status. CVSS 2.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L) indicates low severity: network vector and low complexity, but requires authenticated login (PR:L), limiting scope to users with valid FTP credentials. EPSS 0.12% (30th percentile) reflects minimal real-world exploitation probability, likely because very few devices remain in active use after five years of discontinuation. The public exploit availability (E:P) elevates concern slightly but does not override the practical barrier: an attacker must first obtain FTP credentials on a legacy device. The vulnerability grants only read access to the filesystem (VC:L, confidentiality impact only); no code execution or system modification is possible. SSVC framework: exploitability is functional (POC exists), but technical impact is low (file disclosure only) and automatable only for authenticated users. Real priority: this is a low-severity legacy-system disclosure risk, not a critical remote code execution threat.

An attacker with valid FTP credentials (obtained via credential reuse, weak password, or insider access) connects to the FTP service on a BR-6208AC running firmware 1.02. The attacker sends an FTP RETR command with a path traversal payload such as 'RETR ../../etc/passwd' to escape the FTP root directory and download sensitive configuration files or system files from the router. The publicly available exploit automates this process, allowing the attacker to enumerate and download files such as configuration backups, routing tables, or DHCP lease information without authenticated shell access to the device.