Edimax BR-6208AC CVE-2026-116227

Exploitation requires access to the Virtual Server configuration page of the Edimax BR-6208AC web management interface, which per the CVSS vector demands high privileges (PR:H) - i.e. an authenticated administrator session - and passive user interaction (UI:P) by a victim who subsequently views the affected page. Limiting factors: the attacker must already hold administrative access to the device console, a victim must load the manipulated Virtual Server page, and impact is confined to low integrity (script execution in the browser) with no confidentiality or availability effect. The specific field or parameter that carries the injected payload is not described in the available sources. No vendor-confirmed fix is available.

This is a low-priority issue, and multiple independent signals agree on that. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N) yields a base score of only 1.9: although the attack vector is network-reachable, it requires high privileges (PR:H - i.e. an authenticated administrator) plus passive user interaction (UI:P), and the only impact is low integrity (VI:L) with no confidentiality or availability loss and no subsequent-system impact. This profile is typical of an administrator-injected XSS in a device management page. No EPSS score and no KEV listing were provided, so there is no evidence of active exploitation; the vuln.today decision label is 'monitor', consistent with the low CVSS and the absence of exploitation signals. A public PoC reference exists (a GitHub repository) but it is not verified as working exploit code, so this is a disclosed-but-unweaponized issue rather than a confirmed exploit. The main caveat is the PR:H requirement: because an attacker who already holds admin credentials can usually change router settings directly, the practical added value of this XSS is limited to cross-user/session scenarios, which further lowers real-world risk. No signals conflict here - low score, no KEV, no EPSS, unverified PoC, and a 'monitor' label all point the same direction.

An authenticated administrator (or an attacker who has obtained admin access) injects a malicious script into an input on the Virtual Server configuration page; the stored/reflected script then executes in the browser of a user who views that page. Because the CVSS vector requires high privileges (PR:H) and user interaction (UI:P), realistic abuse is limited to a privileged attacker targeting another console user. A public PoC reference exists but is not verified as working exploit code.