Edimax BR-6208AC: Buffer overflow in formWlSiteSurvey
Summary
Edimax BR-6208AC firmware 1.32 contains a buffer overflow in the web handler /goform/formWlSiteSurvey, which is used for wireless site surveys. The flaw is triggered by a manipulated ifname argument, and a public proof of concept exists. The device is end-of-life, so no fix is expected and the vendor did not respond to the disclosure.
Affected
- Edimax BR-6208AC, firmware 1.32 (per CVE and VulDB records)
- Version assignment to hardware V1 or V2 is unresolved; verify the device label and firmware on site
Fixed in
Unknown. The vendor has discontinued the product and will not develop further firmware updates or security patches for it.
Workaround
- No CVE-specific vendor mitigation known.
- Restrict access to the router's web management interface to trusted internal networks.
- Disable remote (WAN) management.
Exploitation
- Remote exploitation is possible; the attack is not automatable according to CISA SSVC.
- A public proof of concept has been published (CISA SSVC: Exploitation poc).
- Exploitation requires low privileges according to the CVSS vector (PR:L).
Our recommendation
- Check whether any BR-6208AC device is reachable from the internet or untrusted networks and disconnect it immediately if so.
- Plan replacement with a currently supported router.
- Until replaced, limit management access to trusted hosts and monitor for unusual requests to the web interface.
- Verify the hardware version and firmware of all devices in inventory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-108914 vuldb.com
- VulDB entry 416726 vuldb.com
- GitHub proof of concept repository (Iot_vuls) github.com
- Edimax security notice BR-6208AC V2 www.edimax.com
- OpenCVE CVE-2026-108914 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:46.
Original description (NVD)
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.