Edimax BR-6208AC CVE-2026-108935

Exploitation requires authenticated administrative access to the BR-6208AC web management interface (PR:H) and targets the Port Forwarding configuration handler at /goform/formPortFw. The injected script only executes when a user - realistically an administrator - subsequently loads the affected Port Forwarding Page (UI:P/user interaction required). Limiting factors: the attacker must already hold high privileges on the device, a victim must view the malicious entry, and impact is restricted to script execution in the browser context (low integrity) with no direct confidentiality or availability effect. This is a config-page stored/reflected XSS, not a pre-auth remote flaw.

This is a genuinely low-priority issue despite the 'network' attack vector. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) yields a Medium 4.8 score, and the key limiting metrics tell the real story: PR:H means the attacker already needs high (administrative) privileges on the router's web interface, and UI:P means a victim must interact for the payload to fire. Impact is confined to low integrity (VI:L) with no confidentiality or availability loss - consistent with reflected/stored XSS. Exploitation signals are mixed: a public PoC exists (GitHub), raising the Exploit Maturity to E:P, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active or widespread exploitation. The requirement for pre-existing admin access largely collapses the practical threat - an attacker who can already authenticate as admin to a SOHO router has little to gain from XSS against that same admin panel, unless chaining via a lower-privileged or tricked administrator. Net: real but marginal risk; prioritize well below unauthenticated RCE or KEV-listed flaws.

An attacker with administrative access to the Edimax BR-6208AC web UI injects a malicious script into the Port Forwarding configuration via /goform/formPortFw; when an administrator subsequently views the Port Forwarding page, the script executes in their browser session. A public proof-of-concept is available on GitHub, lowering the effort to reproduce, but exploitation still requires both privileged access and victim interaction.