Edimax BR-6208AC CVE-2026-108917

Requires network reachability to the router's HTTP management interface and the ability to invoke the firmware auto-upgrade handler at /goform/formAutoFWupgrade; the injection is delivered through the tftpsIP parameter (normally a TFTP server IP for firmware fetch), so unsanitized shell metacharacters in that argument trigger command execution. Per the supplied CVSS 4.0 vector no authentication or user interaction is required (PR:N/UI:N), though this pre-auth claim is VulDB-sourced and unverified against the vendor. Realistic limiting factors: the management interface must be reachable from the attacker's position (WAN exposure is far riskier than LAN-only), and only the end-of-life BR-6208AC 1.32 is in scope - there is no patch, so compensating controls (disable remote/WAN admin, network segmentation, device replacement) are the only mitigations.

Signals mostly align toward elevated real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, no-authentication, no-user-interaction command injection with full high impact to confidentiality, integrity, and availability, scoring 9.3. POC/exploit code is publicly available (GitHub PoC referenced by VulDB), which raises practical exploitability. However, this is NOT confirmed actively exploited: it is absent from CISA KEV, so this is 'publicly available exploit code exists', not in-the-wild exploitation. No EPSS score and no SSVC decision data were provided, so exploitation probability and automatability cannot be quantified from the input. Two tempering factors matter: (1) the device is an end-of-life Edimax BR-6208AC SOHO router that the vendor explicitly no longer supports and did not respond to disclosure, so no patch will ever ship - defenders must mitigate by replacement/segmentation; and (2) its small, consumer/retired deployment footprint limits the aggregate attack surface despite the critical score. The PR:N (unauthenticated) claim comes solely from the VulDB-supplied vector and could not be independently corroborated against the vendor; firmware-upgrade endpoints frequently sit behind authentication, so verify whether session/credentials are actually required before treating this as fully pre-auth.

A remote attacker sends a crafted HTTP request to the router's /goform/formAutoFWupgrade endpoint with a malicious value in the tftpsIP parameter, injecting shell metacharacters that the firmware passes to an OS command. Because a public PoC exists (fizz-is-on-the-way/Iot_vuls), the attacker can run arbitrary commands on the device - typically as root on embedded Linux - gaining full control to pivot into the LAN or enlist the router in a botnet. Low attack complexity and (per the supplied vector) no authentication make this straightforward against any exposed device.