A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Critical 10.0
CVE-2026-108918
Edimax BR-6208AC — command injection.
A vulnerability was identified in Edimax BR-6208AC 1.32.
Published Updated Source NVD
CVSS 3.1
10.0
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
2.0%
Higher than 81% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Edimax BR-6208AC, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited