CVE-2026-108917
Received Received - Intake

Command Injection in Edimax BR-6208AC Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108917
EUVD
EUVD-2026-97732

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Edimax BR-6208AC 1.32

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108917 is a pre-authentication remote code execution (RCE) vulnerability in the Edimax BR-6208AC router firmware version 1.32. It exists in the /goform/formAutoFWupgrade endpoint where the tftpsIP parameter is passed unsanitized into a system command. Attackers can inject malicious commands via tftpsIP, which are executed with system privileges.

Detection Guidance

To detect this vulnerability, scan for the affected Edimax BR-6208AC router with firmware version BR-6208AC_1.32. Check if the /goform/formAutoFWupgrade endpoint is accessible and test the tftpsIP parameter for command injection by attempting to inject a harmless command like ';id' and verifying if it executes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the affected router remotely without authentication. This could lead to full system compromise, unauthorized access, data theft, or the router being used as a pivot point for further attacks within the network.

Compliance Impact

This vulnerability allows remote code execution (RCE) on affected devices, which could lead to unauthorized access, data exfiltration, or system compromise. For GDPR, this could result in unauthorized processing of personal data or breaches requiring notification under Articles 33-34. For HIPAA, it may enable access to protected health information (PHI) without authorization, violating safeguards under the Security Rule.

Mitigation Strategies

Since the product is no longer supported, the best mitigation is to replace the Edimax BR-6208AC router with a supported and updated device. If replacement is not immediately possible, isolate the device from untrusted networks and restrict access to the router's administrative interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart