Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-1971 is a cross-site scripting (XSS) vulnerability found in the Edimax BR-6288ACL router, specifically in the function wiz_WISP24gmanual within the file wiz_WISP24gmanual.asp.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the user-controllable input parameter "manualssid" is not properly sanitized or neutralized before being reflected in the web page output.'}, {'type': 'paragraph', 'content': 'This allows an attacker to inject malicious JavaScript code that executes in the context of the router’s web interface.'}, {'type': 'paragraph', 'content': 'The attack can be launched remotely but requires some user interaction and authentication steps.'}, {'type': 'paragraph', 'content': 'The affected product is no longer supported by the vendor, and no known mitigations exist, making replacement with alternative products the recommended action.'}] [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability impacts the integrity of the device’s web interface by allowing attackers to inject and execute malicious scripts.

Exploitation can lead to unauthorized actions performed in the context of the user’s browser, potentially resulting in information disclosure or manipulation of router settings.

Since the attack can be launched remotely and requires some user interaction, it poses a risk especially if an attacker can trick a user into accessing a malicious link or page.

Because the product is end-of-life and unsupported, no patches or fixes are available, increasing the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your network contains Edimax BR-6288ACL routers running firmware version up to 1.12 that expose the vulnerable web interface page wiz_WISP24gmanual.asp.

One method to locate potentially vulnerable devices is to use Google dorking with the query: inurl:wiz_WISP24gmanual.asp.

Additionally, you can attempt to access the URL path /wiz_WISP24gmanual.asp on your Edimax BR-6288ACL devices to verify if the vulnerable function is present.

Since the vulnerability involves the manualssid parameter, testing for reflected or stored cross-site scripting by injecting benign script tags or payloads into this parameter via the web interface could help confirm the presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

There are no known mitigations or countermeasures available for this vulnerability as the affected product is end-of-life and no longer supported by the vendor.

The recommended immediate step is to replace the Edimax BR-6288ACL router with an alternative, supported product to eliminate the risk.

Until replacement, restrict access to the router’s web interface to trusted networks only and avoid exposing it to the internet to reduce the risk of remote exploitation.

Useful 0 Not Useful 0