Br 6208Ac
Monthly
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 lets remote attackers execute arbitrary shell commands on the router by submitting crafted input to the tftpsIP parameter of the /goform/formAutoFWupgrade handler, which normally accepts a TFTP server address for firmware fetch operations. The vendor was contacted about the disclosure but did not respond, and the device is an end-of-life product no longer supported by the maintainer, so no vendor-released patch is expected; publicly available exploit code exists (a GitHub proof-of-concept under an IoT vulnerability repository) and the CVSS 4.0 score of 9.3 reflects a full confidentiality, integrity, and availability impact. The vulnerability is not listed in CISA KEV (no confirmed active exploitation reported), but pre-auth reachability of the HTTP management interface - particularly if WAN administration is enabled - makes this a high-priority exposure for anyone still running the device.
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.
Buffer overflow in Edimax BR-6208AC router firmware version 1.02 allows authenticated remote attackers to achieve complete system compromise via crafted pptpDfGateway parameter to /goform/setWAN endpoint. Public exploit code exists (EPSS probability unknown, not in CISA KEV). The vendor was notified but did not respond, leaving users without official remediation guidance. Attack requires only low-privilege authentication (PR:L) with network access and low complexity (AC:L), making this readily exploitable against internet-exposed management interfaces.
Cross-site scripting in the Virtual Server page of the Edimax BR-6208AC web management interface (firmware 1.32) lets an attacker who already holds an authenticated administrator session inject script that executes when a victim subsequently loads the manipulated page. Impact is confined to low integrity in the victim's browser, with no confidentiality or availability effect, and the CVSS 4.0 base score is 1.9 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N). The vendor was contacted and did not respond, no vendor-released fix is identified, and a public PoC reference exists; it is not verified as working exploit code, and priority signals rate this as monitor-level.
Edimax BR-6208AC firmware 1.32 contains a cross-site scripting vulnerability in the QoS configuration page (/goform/formQoS). An authenticated administrator must be tricked into interacting with a crafted request, after which malicious script can alter page content, but impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists, though active exploitation has not been confirmed (not in CISA KEV); this is a low-priority, high-noise finding rather than an urgent threat.
Cross-site scripting in Edimax BR-6208AC firmware 1.32 lets an authenticated administrator inject script through the /goform/formPortFw Port Forwarding handler; publicly available exploit code exists. Exploitation requires high privileges (PR:H) and user interaction (UI:P) when an administrator later views the affected Port Forwarding page, and the assessed impact is limited to low integrity with no direct confidentiality or availability effect. The vendor was contacted but did not respond, so no vendor-released patch is identified in the available data.
Cross-site scripting in Edimax BR-6208AC 1.32 firmware allows an authenticated administrator to inject script into the HTTP Blocking Page via /goform/formUrlb, with execution occurring when a victim views the affected page. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the independent assessment rates this as a low-priority issue because it requires high administrative privileges and victim interaction. The vendor did not respond to disclosure, and no fixed firmware version is identified.
Cross-site scripting in the web management interface of Edimax BR-6208AC firmware 1.32 allows an authenticated administrator to inject script into the /goform/formFilter packet-filter configuration handler; a victim with administrative access must then interact with the affected page for the payload to execute in their browser. Publicly available exploit code exists, but no CISA KEV active-exploitation confirmation is available, and the risk is low-to-moderate because exploitation requires high administrative privileges and user interaction while targeting a LAN-facing management endpoint rather than an unauthenticated internet service. The vendor was contacted but did not respond, and no vendor-released patch has been identified.
Unauthenticated remote command injection in the end-of-life Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP web-management interface to execute arbitrary operating-system commands by manipulating the submit-url argument of the /goform/formAccept endpoint. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials and no user interaction are required, and publicly available exploit code exists in the GitHub repository referenced by the disclosure. Edimax was contacted before publication but did not respond and has shipped no patched firmware; the original CVSS 4.0 score of 6.9 understates the confidentiality, integrity and availability impact compared with the independent assessment, and overall exploitability is governed mainly by whether the management interface is reachable from the WAN or only from the local network, making this a moderate real-world priority.
Command injection in Edimax BR-6208AC 1.02 allows authenticated remote attackers to execute arbitrary system commands via the L2TPUserName parameter in the /goform/setWAN endpoint when L2TP Mode is configured. The vulnerability requires valid credentials but carries moderate risk (CVSS 6.3) with publicly available exploit code and vendor non-responsiveness to disclosure.
Unauthenticated command injection in Edimax BR-6208AC firmware version 1.32 lets remote attackers execute arbitrary shell commands on the router by submitting crafted input to the tftpsIP parameter of the /goform/formAutoFWupgrade handler, which normally accepts a TFTP server address for firmware fetch operations. The vendor was contacted about the disclosure but did not respond, and the device is an end-of-life product no longer supported by the maintainer, so no vendor-released patch is expected; publicly available exploit code exists (a GitHub proof-of-concept under an IoT vulnerability repository) and the CVSS 4.0 score of 9.3 reflects a full confidentiality, integrity, and availability impact. The vulnerability is not listed in CISA KEV (no confirmed active exploitation reported), but pre-auth reachability of the HTTP management interface - particularly if WAN administration is enabled - makes this a high-priority exposure for anyone still running the device.
Stack-based buffer overflow in the Edimax BR-6208AC router running firmware 1.32 allows remote authenticated attackers to corrupt memory via the ateBW argument of the /goform/formWlanMP endpoint, potentially leading to code execution or denial of service. The product is end-of-life and the vendor did not respond, so no vendor patch exists; publicly available exploit code exists, but there is no evidence of confirmed widespread exploitation. Exploitation requires network access to the device's management interface and low-privilege authentication per the CVSS vector (PR:L), which limits anonymous internet-wide attacks; the realistic threat is highest where the admin interface is reachable by untrusted or semi-trusted users.
Buffer overflow in Edimax BR-6208AC router firmware version 1.02 allows authenticated remote attackers to achieve complete system compromise via crafted pptpDfGateway parameter to /goform/setWAN endpoint. Public exploit code exists (EPSS probability unknown, not in CISA KEV). The vendor was notified but did not respond, leaving users without official remediation guidance. Attack requires only low-privilege authentication (PR:L) with network access and low complexity (AC:L), making this readily exploitable against internet-exposed management interfaces.
Cross-site scripting in the Virtual Server page of the Edimax BR-6208AC web management interface (firmware 1.32) lets an attacker who already holds an authenticated administrator session inject script that executes when a victim subsequently loads the manipulated page. Impact is confined to low integrity in the victim's browser, with no confidentiality or availability effect, and the CVSS 4.0 base score is 1.9 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N). The vendor was contacted and did not respond, no vendor-released fix is identified, and a public PoC reference exists; it is not verified as working exploit code, and priority signals rate this as monitor-level.
Edimax BR-6208AC firmware 1.32 contains a cross-site scripting vulnerability in the QoS configuration page (/goform/formQoS). An authenticated administrator must be tricked into interacting with a crafted request, after which malicious script can alter page content, but impact is limited to low integrity with no confidentiality or availability loss. Publicly available exploit code exists, though active exploitation has not been confirmed (not in CISA KEV); this is a low-priority, high-noise finding rather than an urgent threat.
Cross-site scripting in Edimax BR-6208AC firmware 1.32 lets an authenticated administrator inject script through the /goform/formPortFw Port Forwarding handler; publicly available exploit code exists. Exploitation requires high privileges (PR:H) and user interaction (UI:P) when an administrator later views the affected Port Forwarding page, and the assessed impact is limited to low integrity with no direct confidentiality or availability effect. The vendor was contacted but did not respond, so no vendor-released patch is identified in the available data.
Cross-site scripting in Edimax BR-6208AC 1.32 firmware allows an authenticated administrator to inject script into the HTTP Blocking Page via /goform/formUrlb, with execution occurring when a victim views the affected page. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the independent assessment rates this as a low-priority issue because it requires high administrative privileges and victim interaction. The vendor did not respond to disclosure, and no fixed firmware version is identified.
Cross-site scripting in the web management interface of Edimax BR-6208AC firmware 1.32 allows an authenticated administrator to inject script into the /goform/formFilter packet-filter configuration handler; a victim with administrative access must then interact with the affected page for the payload to execute in their browser. Publicly available exploit code exists, but no CISA KEV active-exploitation confirmation is available, and the risk is low-to-moderate because exploitation requires high administrative privileges and user interaction while targeting a LAN-facing management endpoint rather than an unauthenticated internet service. The vendor was contacted but did not respond, and no vendor-released patch has been identified.
Unauthenticated remote command injection in the end-of-life Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP web-management interface to execute arbitrary operating-system commands by manipulating the submit-url argument of the /goform/formAccept endpoint. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials and no user interaction are required, and publicly available exploit code exists in the GitHub repository referenced by the disclosure. Edimax was contacted before publication but did not respond and has shipped no patched firmware; the original CVSS 4.0 score of 6.9 understates the confidentiality, integrity and availability impact compared with the independent assessment, and overall exploitability is governed mainly by whether the management interface is reachable from the WAN or only from the local network, making this a moderate real-world priority.
Command injection in Edimax BR-6208AC 1.02 allows authenticated remote attackers to execute arbitrary system commands via the L2TPUserName parameter in the /goform/setWAN endpoint when L2TP Mode is configured. The vulnerability requires valid credentials but carries moderate risk (CVSS 6.3) with publicly available exploit code and vendor non-responsiveness to disclosure.