Edimax BR-6208AC CVE-2025-15257

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no user interaction, and no special attack configuration prerequisites are required as assessed by the reporter. The attacker must have network-layer reachability to the device's web-based management interface - specifically the /gogorm/formRoute endpoint. The vulnerability is scoped to firmware versions 1.02 and 1.03 of the BR-6208AC V2 only; no other versions or products are confirmed affected. The primary factor limiting exploitation is management interface reachability: devices whose management port is bound exclusively to the LAN interface, or whose management traffic is blocked at an upstream firewall, restrict exploitation to an attacker already present on the local network. Caution: the PR:N (no authentication) claim from the CVSS vector has not been independently verified against the device's actual access control behavior - if the formRoute endpoint is in fact protected by router login credentials, exploitation requires valid credentials (PR:L or PR:H), substantially reducing real-world risk.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as network-exploitable, low-complexity, and requiring no authentication or user interaction - attributes that typically drive high prioritization. The officially assigned CVSS 4.0 base score of 5.5 and limited impact metrics (VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) moderate the raw severity, and the EPSS score of 0.39% at the 60th percentile suggests the PoC has not yet translated into widespread opportunistic exploitation. The E:P supplemental metric in the provided vector confirms exploit code is publicly available, closing the window between disclosure and potential abuse. The most significant compounding risk factor is the confirmed EOL status: with no patch forthcoming from the vendor, every affected device that remains deployed is permanently exposed. Enterprise risk is bounded by the product's SOHO footprint; however, SOHO routers are frequently misconfigured with management interfaces exposed to the WAN, which, combined with the PR:N vector claim, elevates real-world exploitability for affected owners. Note that the PR:N claim from the NVD-published vector should be independently verified - SOHO router management interfaces commonly require authentication, and if credentials are in fact required, the effective risk profile narrows significantly.

An attacker with network access to the BR-6208AC V2 management interface sends a crafted HTTP POST request to /gogorm/formRoute, embedding OS command metacharacters within the strIp, strMask, or strGateway fields - for example, appending a semicolon followed by an arbitrary shell command to what appears to be a valid IP address string. Since a public PoC is available and the CVSS vector indicates no authentication or user interaction is required, the attack is low-effort and scriptable. Successful exploitation yields arbitrary command execution in the router firmware context, enabling an attacker to exfiltrate credentials from the device configuration, modify routing tables to intercept or redirect traffic, or pivot into the connected local network.