CVE-2026-122051
Deferred Deferred - Pending Action

Command Injection Vulnerability in Edimax BR-6208AC Router

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122051

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Edimax BR-6208AC 1.32

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the Edimax BR-6208AC router firmware version 1.32. It exists in the /goform/mp endpoint where user input in the 'command' parameter is passed unsafely to a system() call without proper sanitization. Attackers can exploit this by sending crafted POST requests to execute arbitrary commands on the device remotely.

Detection Guidance

To detect this vulnerability, check if your Edimax BR-6208AC router is running firmware version 1.32. Use network scanning tools like Nmap to identify the device and verify the exposed /goform/mp endpoint. Send a POST request with a test command parameter to see if arbitrary command execution is possible.

Impact Analysis

This vulnerability allows attackers to gain full control over your Edimax BR-6208AC router. They can execute any command with the highest privileges, potentially stealing data, installing malware, or using your device as part of a botnet. Since it requires no authentication, any device exposed to the internet is at risk.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing health information. A successful exploit may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Immediately update the router firmware to the latest version if available. If no patch exists, isolate the device from untrusted networks, disable remote access, and monitor for suspicious activity. Contact Edimax support for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122051. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...