Edimax BR-6208AC CVE-2026-108934

Exploitation requires the attacker to already possess high (administrator) privileges on the BR-6208AC web management interface (CVSS PR:H) and targets the HTTP Blocking Page functionality reached via /goform/formUrlb. The payload only triggers when a user passively views the affected page (CVSS UI:P), so it is not self-firing. These two factors - pre-existing admin authentication and required victim interaction - are the primary limiters that keep real-world risk low despite the network-reachable (AV:N) interface; there is no known fixed firmware version because the vendor did not respond to disclosure.

This is a low-priority issue that scores low across nearly every signal, and the data is internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) yields a base score of only 1.9, driven down by two significant barriers: PR:H means the attacker already needs high (administrator-level) privileges on the device, and UI:P means a victim must passively interact for the payload to fire. Impact is limited to low integrity (VI:L) with no confidentiality or availability consequence - consistent with a reflected/stored XSS on an admin-facing page. On the exploitation side, a public POC exists (VulDB-referenced GitHub repo), but there is NO CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals and must not be conflated. The one point worth verifying: the SSVC/technical reality of 'HTTP Blocking Page' XSS plus PR:H suggests an admin-authenticated vector attacking either another admin or itself, which materially limits real-world value. No key signals conflict here; the picture is a genuine-but-minor vulnerability, not a high-CVSS/low-real-risk mismatch.

An attacker who already holds administrative access to the Edimax BR-6208AC web interface injects a crafted script into the /goform/formUrlb endpoint tied to the HTTP Blocking Page component; the stored/reflected payload then executes in the browser of a user who views the affected page. A public POC exists in the referenced GitHub repository, lowering the effort to reproduce, though the required admin privileges (PR:H) and victim interaction (UI:P) sharply constrain practical impact.