Edimax BR-6208AC: Buffer overflow in formWlanMP via ateBW parameter
Summary
A buffer overflow in the web management function /goform/formWlanMP of the Edimax BR-6208AC router allows a remote attacker to crash the web server with a crafted POST request. The vulnerable parameter is ateBW, which is passed unchecked into a shell command string. The CVE vector lists high impact on confidentiality, integrity and availability and requires low privileges, but the authentication requirement for this function is not confirmed. A public write-up exists, and the vendor has ended support without planning a fix.
Affected
- Edimax BR-6208AC, firmware 1.32 (per VulDB and the CVE record)
- The hardware revision for firmware 1.32 is unverified. Check the device label and firmware version before assuming scope.
Fixed in
Unknown. No fix is available. Edimax states that it will not develop new firmware updates or security patches for these models.
Workaround
- Remove port forwarding and WAN exposure to the router's web management interface.
- Disable remote management.
- Limit admin access to a management VLAN or trusted LAN hosts.
- Segment IoT and guest Wi-Fi from core networks.
- Monitor the device for crashes or reboots, which may indicate exploitation attempts.
Exploitation
- Public proof of concept: yes (researcher write-up on GitHub).
- Known exploitation in the wild: not known. The CVE is not listed in KEV.
- CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'.
Our recommendation
- Replace the BR-6208AC with a supported model. Edimax recommends its latest Wi-Fi 6 series.
- Until replacement, make sure the web interface is not reachable from the internet and restrict admin access to trusted hosts.
- Change default credentials if any are still set.
- Check the device for crashes or unexplained reboots and review logs.
- Note that the CVSS 4.0 score of 8.6 provided with this entry could not be verified against NVD. Confirm it before using it in a report.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE entry CVE-2026-108915 vuldb.com
- VulDB vulnerability 416727 vuldb.com
- Public write-up on GitHub (Iot_vuls) github.com
- Edimax security notice for BR-6208AC V2 (end of life) www.edimax.com
- Vulners NVD record CVE-2026-108915 vulners.com
- Edimax BR-6208AC v2 technical info techinfodepot.shoutwiki.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:41.
Original description (NVD)
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.