EUVD-2026-97574
GHSA-2xrv-gr5x-xvx9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend oversized ifname to /goform/formWlSiteSurvey
-
ExecutionOverflow buffer in handler
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the device's HTTP management interface and invoking the /goform/formWlSiteSurvey endpoint with a malicious 'ifname' argument; the CVSS vector's PR:L indicates at least low-privilege authenticated access to that interface is needed, so this is not a default-config unauthenticated remote takeover. Limiting factors: attacker must have management-interface access (LAN exposure or an internet-exposed admin panel plus valid/default credentials), and the affected product (Edimax BR-6208AC firmware 1.32) is end-of-life with no patch forthcoming, so the realistic victim set is limited to legacy deployments. UI:N means no user interaction is required once the endpoint is reachable with credentials. |
| Impact | Signals are mixed and point to a genuine but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high vulnerable- and subsequent-system impacts yields 8.6, and a public exploit exists (E:P in the vector plus a published GitHub PoC), so the technical severity is real: a network-reachable buffer overflow in the router's web/goform handler. However, several high-risk amplifiers are ABSENT or unknown: no CISA KEV listing (not confirmed actively exploited) and no EPSS score was provided, so widespread opportunistic exploitation cannot be asserted - only that weaponizable code is public. Crucially, PR:L means exploitation is NOT unauthenticated; an attacker needs at least low-privilege access to the management interface, which sharply limits internet-wide mass exploitation unless the admin panel is exposed with default/weak credentials. The decisive mitigating fact is that this is an end-of-life product the vendor no longer supports and did not respond to disclosure, so no patch will ever ship - risk is permanent for anyone still running it but confined to a niche, aging device population. Net: a legitimate 'replace the device' priority for the small set of affected deployments, not a broad enterprise emergency. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the BR-6208AC web management interface sends a crafted request to /goform/formWlSiteSurvey with an overlong 'ifname' argument, overflowing a stack/heap buffer in the handler. A public proof-of-concept is available (published GitHub PoC), so exploitation is reproducible and could lead to device crash or arbitrary code execution on the router. Because PR:L is required, the realistic entry point is a management panel reachable from the LAN or exposed to the internet with obtained or default credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Buffer overflow in the Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP management interface to corrupt memory via a crafted 'ifname' argument sent to the /goform/formWlSiteSurvey endpoint, with high impact to confidentiality, integrity, and availability. Exploitation requires at least low-privileged authenticated access to the web UI (CVSS 4.0 vector PR:L; independently assessed CVSS 3.1 base 8.6), meaning the endpoint must be reachable either from the LAN or from an internet-exposed admin panel using valid or default credentials; no user interaction is required once the attacker is authenticated. Publicly available exploit code exists (a PoC walkthrough is published on GitHub), but there is no evidence of confirmed active exploitation in the wild, and the vendor did not respond to disclosure - the product is end-of-life and no fix is expected.
RemediationAI
No vendor-released patch was identified at time of analysis: the vendor was contacted early, did not respond, and the BR-6208AC is explicitly out of support, so firmware 1.32 cannot be fixed by upgrade - the durable remediation is to replace the device with a supported router. Until replacement is possible, apply compensating controls that reduce reachability of the vulnerable handler: disable remote/WAN administration and UPnP port-forwarding so the web UI is reachable only from the trusted LAN, change all default and weak administrative credentials, and restrict the management subnet to known admin hosts (these controls reduce exposure but do not remove the overflow, and they fail if an attacker already has LAN access or valid credentials). If the site-survey function is not needed, block or drop HTTP requests to /goform/formWlSiteSurvey at the network boundary and monitor device logs for repeated requests to that path as an exploitation indicator; note that blocking by URI requires a TLS-terminating or layer-7 inspection point, which the device's plain-HTTP admin interface does not provide by default. As a lower-cost trade-off, isolate the router on a dedicated VLAN with no access to other network segments so a successful overflow cannot pivot into managed hosts. Track the VulDB advisory pages (https://vuldb.com/vuln/416726 and /cti) for any late vendor response, but plan on hardware replacement rather than a firmware fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-119 memory-safety defect: a length-unvalidated input buffer ('ifname') supplied to the /goform/formWlSiteSurvey CGI handler is copied into a fixed-size stack or heap buffer without bounds checking, allowing an attacker to overwrite adjacent memory. The '/goform/' URI prefix is characteristic of the GoAhead/embedded web-server form-handling pattern widely used in consumer routers, where each form handler parses HTTP parameters with minimal validation. Because the vulnerable product is the Edimax BR-6208AC running firmware 1.32, the attack surface is the device's administrative web service rather than the wireless or WAN protocol stack; the handler appears to be part of the wireless site-survey configuration path, which is why the attacker-controlled parameter is the interface name. Both the NVD CVSS 4.0 evaluation (8.6) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agree the impact class is full loss of confidentiality, integrity, and availability on the device, but the independent assessment constrains the vector with PR:L - i.e., the attacker must already hold at least low-privilege credentials on the management interface, so this is not a pre-auth, default-configuration remote takeover.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable goform endpoint (AV:N/AC:L) but requires authenticated management access (PR:L); buffer overflow yields full device code execution, so C/I/A:H and scope unchanged.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Executive ViewAI
The Edimax BR-6208AC router (firmware 1.32), a discontinued device, contains a high-severity buffer overflow that an authenticated attacker with low-privileged access to the web management interface can use to corrupt memory and fully compromise confidentiality, integrity, and availability. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, so any organization still using these routers must treat them as untrusted and prioritize isolation or replacement. Leadership should care because these edge devices, if internet-exposed with default credentials, could become a pivot point into internal systems.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the HTTP management interface to trusted administrative VLANs, change default and weak credentials, disable remote administration, enforce network segmentation with firewall rules blocking inbound access to the management interface from untrusted networks, deploy IPS signatures to block crafted ifname requests to /goform/formWlSiteSurvey, monitor logs for exploitation attempts, and plan to replace end-of-life devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB