CVE-2026-108936

Received Received - Intake

Cross-Site Scripting in Edimax BR-6208AC Router

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description

A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-108936

Affected Vendors & Products

Vendor	Product	Version / Range
Edimax	BR-6208AC	1.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in the Edimax BR-6208AC router version 1.32. It exists in the QoS Page component, specifically in the file /goform/formQoS. An attacker can remotely inject malicious scripts into this page, potentially stealing user data or performing unauthorized actions.

Impact Analysis

If exploited, this XSS vulnerability could allow attackers to steal sensitive information like cookies or session tokens, redirect users to malicious sites, or perform actions on behalf of users. It may also enable phishing attacks or unauthorized access to the router's admin interface.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (if personal data is exposed) or HIPAA (if health-related data is compromised). Organizations using this router may face compliance violations, legal penalties, and reputational damage due to inadequate security measures.

Mitigation Strategies

Immediately update the Edimax BR-6208AC firmware to the latest version if available. Disable the QoS page feature if not required. Monitor network traffic for suspicious XSS attempts targeting /goform/formQoS. Restrict access to the device's web interface from untrusted networks.

Hi! I’m here to help you understand CVE-2026-108936. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70