Edimax BR-6208AC CVE-2025-15256

The device's web-based configuration interface must be reachable by the attacker over the network - exploitation requires HTTP access to port 80 or 443 on the device. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required and no victim interaction is needed, meaning the attack can be launched directly against any reachable device. The vulnerability is limited to the BR-6208AC V2 running firmware 1.02 or 1.03 specifically - other Edimax models are not indicated as affected. The rootAPmac parameter is likely only present in requests related to WDS/repeater or station driver configuration; however, the web interface itself being accessible is the primary prerequisite. Devices with management interfaces firewalled from untrusted networks (internet or untrusted LAN segments) are not directly remotely exploitable, but LAN-side attackers face no authentication barrier.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) presents an extremely low-friction attack profile - unauthenticated, no complexity, no user interaction required. The official scored severity of 5.5 reflects only low-level impacts (VC:L/VI:L/VA:L), which is notably conservative for an OS command injection vulnerability and may understate real-world impact; OS command injection on embedded firmware typically yields full device compromise rather than partial confidentiality/integrity exposure. EPSS at 0.53% (67th percentile) suggests meaningful relative risk compared to most CVEs but not widespread automated exploitation. No CISA KEV listing means active exploitation is not confirmed by authoritative sources. A publicly available exploit (referenced via NVD exploit tags and a researcher Notion writeup) lowers the exploitation bar significantly. The permanent absence of a patch due to EOL status converts this from a temporary to a structural risk - the only true remediation is device replacement. The realistic threat is a network-adjacent or internet-facing device being compromised by an attacker with access to the public PoC.

An attacker who can reach the BR-6208AC web interface - either from the internet if port 80/443 is forwarded, or from the local network - sends a crafted HTTP POST request to /goform/formStaDrvSetup with the rootAPmac parameter containing shell metacharacters (e.g., a semicolon followed by an arbitrary command). The firmware passes the unsanitized value directly to an OS-level command interpreter, executing the injected payload with the privileges of the web server process. A public proof-of-concept is documented and referenced in NVD, enabling exploitation by actors with minimal technical skill.