Edimax BR-6208AC CVE-2025-15258

Exploitation requires authenticated login to the BR-6208AC web configuration interface (authenticated access with user credentials or session cookie) plus user interaction (UI:P) - the victim must click a malicious link or be redirected by the attacker through other means. The vulnerability specifically affects firmware versions 1.02 and 1.03 of the BR-6208AC V2 model. The /goform/formALGSetup endpoint must be accessible, which is the case in standard out-of-the-box configurations. Unauthenticated remote users cannot directly exploit this vulnerability without first compromising administrator credentials; however, social engineering can lower this bar by tricking authenticated administrators into clicking malicious links.

Despite the CVSS score of 2.0 and very low EPSS percentile (12%), this vulnerability presents minimal real-world risk due to multiple limiting factors: (1) requires authenticated access (PR:L), eliminating opportunistic exploitation against default deployments; (2) requires user interaction (UI:P), as victims must click the malicious link; (3) causes only indirect integrity impact via redirection, not direct system compromise; (4) the affected device is end-of-life with no user base actively receiving security updates. The CVSS vector and EPSS score alignment indicates this is correctly classified as low-priority. Public POC availability increases discoverability risk for small organizations still operating unsupported BR-6208AC devices, but the authentication requirement prevents widespread automated exploitation. This is a genuine low-risk vulnerability appropriate for inventory tracking but not executive escalation.

A user with administrative credentials (or whose account was compromised) receives a phishing email containing a link like https://[router-ip]/goform/formALGSetup?wlan-url=http://attacker.com/phishing. When the user clicks this link while logged into the router's web interface, the router validates their authentication and then redirects them to the attacker's site, potentially harvesting credentials for other services or distributing malware. Public POC code is available, enabling attackers to rapidly generate such links.