Edimax BR-6208AC EUVD-2026-97976

Exploitation requires an authenticated session with high (administrative) privileges on the BR-6208AC web management interface in order to submit the malicious input to the /goform/formFilter endpoint (the MAC/IP packet-filter configuration handler), consistent with PR:H in the vector. Successful payload execution additionally requires a victim user to interact with the affected administrative page (UI:P), so the injected script runs in that user's browser context. Limiting factors that reduce real-world risk: the attacker cannot reach the vulnerable function without valid admin credentials, there is a mandatory user-interaction step, and exploitation targets the local/LAN-facing router management UI rather than an internet-exposed unauthenticated service by default.

This is a low-to-moderate real-world risk that does not warrant emergency prioritization. The CVSS 4.0 base score of 4.8 (MEDIUM) is driven down by two significant limiting factors in the input vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N): PR:H means the attacker must already hold high (administrative) privileges on the router, and UI:P means a victim must interact with the malicious content. Publicly available exploit code exists (POC=YES via GitHub), which raises the practical likelihood of opportunistic use, and this is reflected in the input vector's E:P (Proof-of-Concept) exploit maturity. However, there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation - the signal is POC availability only, which must not be conflated with in-the-wild attacks. The combination of a self-XSS-like precondition (an attacker needing PR:H admin access to inject the payload that then targets another admin) substantially narrows realistic attack scenarios. Note a tension worth verifying: the description says 'The attack can be executed remotely' while the vector requires PR:H and UI:P - remote here means network-reachable, not unauthenticated, so this is NOT a remote-unauthenticated issue. Verdict: genuine but low-urgency, typical of an authenticated stored/reflected XSS in a SOHO router config endpoint reported by VulDB.

An attacker with authenticated administrative access to the Edimax BR-6208AC web interface submits a crafted value to the /goform/formFilter endpoint, planting a cross-site scripting payload in the filter configuration. When another administrator later views the affected page, the script executes in their browser session, potentially stealing session tokens or altering router settings. Publicly available proof-of-concept exploit code exists on GitHub, lowering the barrier to reproduction.