Edimax BR-6208AC EUVD-2026-26820

Exploitation requires (1) authenticated access to the BR-6208AC administrative web interface (PR:L in CVSS vector), (2) the L2TP Mode feature to be configured or enabled in the WAN settings, and (3) the ability to submit a POST or GET request to the /goform/setWAN endpoint with the L2TPUserName parameter containing command injection payload. These conditions limit exploitation to attackers who have valid credentials, distinguishing this from unauthenticated network RCE. However, credentials may be compromised through weak default passwords (common in SOHO routers), network-level credential capture, or phishing. The presence of publicly available exploit code indicates these exploitation steps are well-documented and easy to execute.

CVSS 6.3 reflects network-accessible attack vector (AV:N), low complexity (AC:L), but importantly requires authenticated privileges (PR:L), limiting exposure to users with valid router credentials. EPSS data not provided, but the public availability of exploit code and vendor non-responsiveness elevate practical risk beyond the base score. The CVSS vector includes E:P (Proof of Concept Exists) and RL:X (Remedy Level Unknown), confirming exploit availability and lack of vendor patch. Real-world risk is moderate: this affects small office/home office routers where local network access and authentication may be easier for attackers than on enterprise devices, but the authentication requirement prevents unauthenticated remote exploitation. The combination of confirmed POC, vendor silence on remediation, and the sensitive nature of WAN configuration (potential for network redirection or DoS) makes this a material risk for affected organizations, particularly those managing multiple BR-6208AC deployments without alternative security controls.

An attacker with valid administrative credentials (e.g., obtained through phishing, credential stuffing, or default password) accesses the router's web interface and navigates to the L2TP WAN configuration page. The attacker injects a shell command payload in the L2TPUserName field (e.g., L2TPUserName=admin; cat /etc/passwd) and submits the form. The vulnerable setWAN function concatenates this unsanitized input into a system command, which is executed by the router's shell with the privileges of the web service process, potentially allowing the attacker to read sensitive files, modify configuration, or establish persistence.