Edimax BR-6208AC
CVE-2025-15257
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint, PR:N per CVSS 4.0 vector, limited C/I/A impacts consistent with NVD VC:L/VI:L/VA:L assessment, no scope change to other systems.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of the component Web-based Configuration Interface. The manipulation of the argument strIp/strMask/strGateway results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Edimax confirms this issue: "The product mentioned, EDIMAX BR-6208AC V2, has reached its End of Life (EOL) status. It is no longer supported or maintained by Edimax, and it is no longer available for purchase in the market. Consequently, there will be no further firmware updates or patches for this device. We recommend users upgrade to newer models for better security." This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Command injection in the Edimax BR-6208AC V2 web-based configuration interface (firmware 1.02 and 1.03) allows remote attackers to execute arbitrary OS commands by manipulating routing parameters in the formRoute handler, with no authentication or user interaction indicated as required per the CVSS 4.0 vector. The vendor has confirmed the device is End of Life and has explicitly declined to release any remediation, making hardware replacement the only definitive fix. A public proof-of-concept exploit exists; no CISA KEV listing was identified at time of analysis, and the EPSS score of 0.39% at the 60th percentile suggests limited observed exploitation to date despite PoC availability.
Technical ContextAI
The vulnerability resides in the formRoute function exposed via the /gogorm/formRoute endpoint of the web-based management interface on the Edimax BR-6208AC V2 SOHO router, confirmed by CPE strings cpe:2.3:o:edimax:br-6208ac_firmware:1.02:*:*:*:*:*:*:* and cpe:2.3:o:edimax:br-6208ac_firmware:1.03:*:*:*:*:*:*:*. CWE-74 (Injection) identifies the root cause class: the parameters strIp (IP address), strMask (subnet mask), and strGateway (default gateway) - intended to accept route configuration values - are passed to an underlying OS command or interpreter without sufficient sanitization, allowing injection of arbitrary shell metacharacters. This pattern is prevalent in embedded networking firmware where input validation on configuration handlers is historically weak or absent, and the proprietary gogorm framework involved offers no additional mitigating abstractions evident from available data.
RemediationAI
No vendor-released patch has been identified at time of analysis, and Edimax has explicitly confirmed that no firmware updates will be produced for the EOL BR-6208AC V2. The only definitive remediation is hardware replacement with a currently supported router model that receives active security maintenance. As immediate compensating controls for devices that cannot yet be replaced: disable remote management access over the WAN interface if it is enabled, which restricts exploitation to attackers already on the local network segment (trade-off: reduces remote administration capability); apply perimeter firewall rules to block external access to the device's web management ports (typically TCP 80, 443, and 8080); and if the device must remain in production, isolate it on a dedicated VLAN with restricted inter-VLAN routing to limit lateral movement in the event of successful exploitation. None of these controls eliminate the underlying vulnerability. The public PoC writeup is available at https://tzh00203.notion.site/EDIMAX-BR-6208AC-V2_1-02-Command-Injection-Vulnerability-in-Web-formRoute-handler-2d3b5c52018a805983d3cf0780b28407 and vulnerability details are indexed at https://vuldb.com/?id.338647.
More in Br 6208ac Firmware
View allEDIMAX BR-6208AC V2 router allows command injection through the pppUserName field via system() without sanitization. PoC
Command injection in the Edimax BR-6208AC V2 web-based configuration interface exposes unauthenticated remote attackers
Edimax BR-6208AC firmware versions prior to 2_1.02 contain an authentication bypass in the auth_check_userpass2 function
Path traversal in the FTP daemon service of Edimax BR-6208AC firmware version 1.02 allows authenticated remote attackers
Open redirect vulnerability in Edimax BR-6208AC firmware versions 1.02 and 1.03 allows authenticated remote attackers to
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today