Edimax BR-6208AC CVE-2026-7685

Exploitation requires the attacker to authenticate to the router's web management interface with at least low-privilege credentials (PR:L per CVSS vector). Default credentials for Edimax devices are publicly documented and frequently unchanged by end users, making this authentication barrier minimal in practice. The vulnerable /goform/setWAN endpoint is part of the standard web UI and does not require any non-default feature enablement - it is present in default configurations for PPTP WAN setup functionality. Network access to the management interface is required (AV:N), either from the internet if remote administration is enabled, or from the local network segment where the router resides. No user interaction is needed (UI:N) once authentication is achieved. Exploitation is NOT limited by specific ISP configurations, VPN settings, or advanced router features - any BR-6208AC running firmware 1.02 with accessible admin interface is vulnerable. The primary limiting factor is the authentication requirement, but this is a weak control given prevalence of default credentials on consumer routers and lack of account lockout mechanisms typical in embedded devices.

Real-world risk is HIGH for exposed devices despite moderate CVSS 7.4 score. The vulnerability requires only authenticated network access (PR:L), but router admin interfaces are frequently exposed to the internet or accessible from compromised internal networks. Attack complexity is LOW (AC:L/AT:N), meaning exploitation is straightforward with the publicly available POC. The Proof-of-Concept existence elevates immediate risk - defenders should assume script kiddie-level threat actors can leverage this within days. However, absence from CISA KEV and lack of EPSS data suggests no widespread exploitation campaigns detected yet. The vendor's non-response is a critical risk multiplier: no official patch exists, no security advisory guidance, and users have no vendor-supported remediation path. This creates long-tail risk as devices remain vulnerable indefinitely. The low privilege requirement (PR:L rather than PR:N) provides minimal defense - default credentials are widely known for consumer routers, and credential stuffing attacks are trivial. Scope is contained to the router (S:U implied by SC:N), preventing direct pivot to backend networks, but compromised routers enable man-in-the-middle attacks, DNS hijacking, and persistent footholds for lateral movement. Priority depends on exposure: internet-facing devices are CRITICAL, internal-only devices are HIGH if network segmentation is weak.

An attacker identifies an Edimax BR-6208AC router exposed on the internet via Shodan search for the device's characteristic web interface fingerprint. They attempt default credentials (admin/1234 or admin/password) against the login page and successfully authenticate with low-privilege access. The attacker crafts an HTTP POST request to /goform/setWAN with an oversized pptpDfGateway parameter containing shellcode, triggering the buffer overflow and overwriting the return address on the stack. Execution redirects to attacker-controlled code running with root privileges on the router's embedded Linux system, allowing installation of persistent backdoors, DNS redirection to phishing sites, or traffic interception for credential harvesting across all devices using the router.