Edimax BR-6208AC CVE-2026-108918

No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/PR:N/UI:N) of the /goform/formWlanMP endpoint via the readE2P parameter on Edimax BR-6208AC firmware 1.32. The practical limiting factor is exposure: the attacker must be able to reach the device's web management interface (internet-facing WAN management, or same LAN/Wi-Fi segment), which is the main constraint since SOHO routers often restrict management to the internal network by default. The decisive aggravating condition is that the product is end-of-life with no vendor patch, so exposed devices remain permanently vulnerable.

Multiple signals converge on genuine high risk, with one tempering factor. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality/integrity/availability impact, and the CWE-74/command-injection classification means successful exploitation yields OS command execution on the device. The vector carries E:P (Proof-of-Concept), consistent with the referenced public exploit on GitHub, so weaponization barriers are low. However, this is NOT a confirmed-actively-exploited case: there is no CISA KEV listing and no EPSS score in the provided data, so real-world exploitation volume cannot be quantified from these inputs - treat exploitation as plausible/emerging rather than confirmed. The decisive risk amplifier is that the product is end-of-life ('no longer supported by the maintainer') and the vendor did not respond to disclosure, meaning NO official patch will be issued - unpatchable devices with public PoC are classic targets for botnet mass-scanning. Net: this is a real priority for anyone operating this hardware, driven less by proven mass exploitation and more by the combination of trivial unauthenticated RCE, available exploit code, and permanent lack of a fix. Missing data to note: no EPSS probability and no KEV confirmation were supplied.

An attacker reachable over the network (internet-facing or LAN) sends a crafted request to /goform/formWlanMP with a malicious value in the readE2P argument, injecting shell metacharacters that the firmware passes to a system command. Because no authentication or user interaction is required (PR:N/UI:N), the attacker gains command execution on the router and can pivot, intercept traffic, or enroll the device into a botnet. A public proof-of-concept exploit is available in the referenced GitHub repository, lowering the skill barrier.