EUVD-2026-97727
GHSA-8mfm-548h-982c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface
-
DeliverySend crafted /goform/formAccept request
-
ExploitInject shell commands via submit-url
-
ExecutionExecute arbitrary commands on device
-
ImpactCompromise router / pivot to LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's HTTP web-management interface and the ability to send a request to the /goform/formAccept endpoint with attacker-controlled input in the submit-url argument. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is needed. The principal limiting factor is exposure of the management interface: routers with their admin interface reachable only from the LAN are exploitable only by on-network or pivoted attackers, whereas WAN-exposed management dramatically widens reach. Because this is an end-of-life Edimax BR-6208AC (firmware 1.32) with no vendor patch, the only mitigations are network segmentation, disabling remote administration, or device replacement. |
| Impact | Moderate real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated command-injection flaw, which is the kind of signal that normally drives urgency. However, several factors temper this: the vendor-supplied 4.0 score of 6.9 (MEDIUM) reflects only LOW vulnerable-system impacts (VC:L/VI:L/VA:L), which is unusually conservative for a CWE-77 command-injection bug that typically yields full device compromise - this is a conflicting signal worth noting, as command injection on embedded routers usually warrants HIGH impact. The Exploit Maturity is E:P (Proof-of-Concept), and a public PoC exists on GitHub, but there is NO EPSS score, NO CISA KEV listing, and no SSVC decision data provided, so automatability and confirmed exploitation cannot be assessed from the input. Critically, this is an END-OF-LIFE product with no vendor response and no patch, meaning exposure is permanent for anyone still running it. The overall picture is a low-footprint, unpatchable device with a working PoC: dangerous where deployed but likely limited to targeted or opportunistic IoT-botnet scanning rather than broad enterprise impact. The only intelligence source is VulDB; no NVD or vendor corroboration is available. |
| Exploit ScenarioDerived | An attacker with network reach to the router's web management interface sends a crafted request to /goform/formAccept with a malicious payload in the submit-url argument, injecting shell commands that execute on the device. A public proof-of-concept is available on GitHub (fizz-is-on-the-way/Iot_vuls), lowering the barrier to exploitation. Because the attack is remote, unauthenticated (PR:N), and low-complexity, it could be automated by IoT botnets scanning for exposed management interfaces. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated remote command injection in the end-of-life Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP web-management interface to execute arbitrary operating-system commands by manipulating the submit-url argument of the /goform/formAccept endpoint. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials and no user interaction are required, and publicly available exploit code exists in the GitHub repository referenced by the disclosure. Edimax was contacted before publication but did not respond and has shipped no patched firmware; the original CVSS 4.0 score of 6.9 understates the confidentiality, integrity and availability impact compared with the independent assessment, and overall exploitability is governed mainly by whether the management interface is reachable from the WAN or only from the local network, making this a moderate real-world priority.
RemediationAI
No vendor-released patch identified at time of analysis: Edimax was notified early but did not respond, the BR-6208AC is end-of-life and unsupported, and no fixed firmware version is available anywhere in the source data, so upgrading is not an option and replacement with a currently supported router is the only complete fix. Until the device can be retired, apply the following compensating controls with their trade-offs: block inbound WAN access to the router's web-management ports (typically TCP 80/443 or any custom admin port) at the upstream firewall or ISP router, accepting that remote administration becomes impossible; disable the device's remote-management/WAN-administration setting if present in the UI, understanding this is a hardening step and not proof of immunity against LAN-side exploitation; place the router on an isolated VLAN or guest network so that only trusted administrative hosts can reach /goform/formAccept, which limits lateral movement at the cost of extra switch/VLAN configuration; and restrict administrative access to a dedicated management subnet where the PoC path can never be reached from user or IoT segments. Detection should focus on POST requests to /goform/formAccept whose submit-url parameter contains shell metacharacters such as semicolons, backticks or pipes, since such traffic is anomalous for legitimate administration. Further details are available at https://vuldb.com/vuln/416728, https://vuldb.com/cve/CVE-2026-108916 and the proof-of-concept at https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formAccept.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command), a classic OS command injection. The BR-6208AC runs an embedded Linux firmware image whose CGI-style web management interface exposes the /goform/ handler namespace; the formAccept handler takes an attacker-supplied submit-url parameter and passes it into a shell invocation without sanitization of shell metacharacters, so injected commands are executed with the privileges of the web server process (typically root or an equivalent privileged daemon on consumer router firmware). Because the vulnerable component is the HTTP management service rather than a feature behind authentication, the exposure surface is the web UI itself: any network path that lets a client POST to /goform/formAccept is sufficient. The CPE string cpe:2.3:a:edimax:br-6208ac:*:*:*:*:*:*:*:* with a wildcard version field and the absence of a fixed-version reference reflect that the vendor has discontinued the product line and no corrected firmware has been published, leaving no configuration-level fix inside the device.
Know when Br 6208Ac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Remote, low-complexity, unauthenticated command injection on an embedded router typically runs with full (root) privilege, so AV:N/AC:L/PR:N/UI:N and C/I/A:H; contrasts with the vendor's conservative LOW impacts.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 lets remote attackers execute arbitrary shel
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers t
Buffer overflow in Edimax BR-6208AC router firmware version 1.02 allows authenticated remote attackers to achieve comple
Command injection in Edimax BR-6208AC 1.02 allows authenticated remote attackers to execute arbitrary system commands vi
Cross-site scripting in Edimax BR-6208AC firmware 1.32 lets an authenticated administrator inject script through the /go
Edimax BR-6208AC firmware 1.32 contains a cross-site scripting vulnerability in the QoS configuration page (/goform/form
Cross-site scripting in the web management interface of Edimax BR-6208AC firmware 1.32 allows an authenticated administr
Cross-site scripting in Edimax BR-6208AC 1.32 firmware allows an authenticated administrator to inject script into the H
Exploit-DB