Edimax BR-6208AC CVE-2026-108936

Exploitation targets the QoS configuration page specifically via the /goform/formQoS handler on the Edimax BR-6208AC (firmware 1.32). Per the CVSS vector, the attacker must hold high privileges (PR:H) - i.e., an authenticated administrative session on the device web UI - and the payload fires only when a user with that interface takes action (UI:P), meaning it is not a drive-by against anonymous users. Limiting factors: administrative authentication to the router management interface is required, victim interaction is needed to trigger the script, impact is confined to Low integrity with no confidentiality or availability effect, and exposure depends on the web management interface being reachable by the attacker (typically LAN-side unless remote management is enabled).

This is a low-priority, high-noise finding rather than an urgent threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) scores only 1.9 - the two dominant risk reducers are PR:H (the attacker must already hold high/administrative privileges on the router) and UI:P (a victim must take some passive action), while confidentiality and availability impact are both None and only integrity is Low. This profile is consistent with a self-/admin-context XSS in a management page rather than a pre-auth takeover. Publicly available exploit code exists (VulDB, with a GitHub PoC), which raises the floor on opportunistic abuse, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation. No SSVC decision data was provided. The signals are internally consistent (low CVSS + PoC-only + no KEV = known but not pressing). The main caveat: the free-text description calls this simply 'cross site scripting ... remotely,' which could read as low-barrier, but the vendor-assigned CVSS explicitly requires PR:H and UI - defenders should trust the vector over the prose. The vendor did not respond to disclosure, so no official patch is confirmed.

An attacker who already has administrative access to the BR-6208AC web interface (or can coerce an authenticated admin) plants a malicious script via the QoS configuration handler at /goform/formQoS. When an administrator subsequently views the affected QoS page, the injected script executes in their browser session. A public proof-of-concept is available on GitHub, lowering the effort to reproduce.