Edimax BR-6208AC: Command injection in formAutoFWupgrade via tftpsIP
Summary
The web management handler /goform/formAutoFWupgrade of the Edimax BR-6208AC router, firmware 1.32, does not sanitize the tftpsIP parameter before passing it to a system command. A remote attacker can inject operating system commands, which the public proof of concept demonstrates on an emulated device. The PoC author describes the flaw as pre-authentication, so no valid login appears to be required. The vendor was contacted but did not respond, and the product is no longer supported.
Affected
- Edimax BR-6208AC firmware 1.32 (per CVE and VulDB records)
- Whether other firmware versions or the BR-6208AC V2 hardware line are affected: Unknown.
Fixed in
- Unknown. No fixed version has been published.
- The vendor has declared the BR-6208AC V2 end-of-life and will not provide new firmware or security patches for these models.
Workaround
- Unknown. The vendor's mitigation section could not be verified.
- Remove WAN-side access to the web interface and disable remote management.
- Isolate the device on a separate network segment.
Exploitation
- Public proof of concept available (VulDB status: Proof-of-Concept).
- Exploit price estimate by VulDB: USD 0 to 5,000.
- CISA SSVC: exploitation poc, automatable yes, technical impact total.
- No known exploitation in the wild; not listed as known exploited (KEV) in the sources checked.
- EPSS: 0.01989.
Our recommendation
- Check whether any BR-6208AC is in use and which firmware version it runs.
- Verify that the web interface is not reachable from the internet.
- Remove the device from service and replace it with a supported model, since no patch is expected.
- If the device was internet-exposed, check it for unexpected processes, files or configuration changes and treat it as compromised if signs are found.
- Monitor for further advisories on this model.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB: CVE-2026-108917 vuldb.com
- CVE-2026-108917 PoC repository (GitHub) github.com
- Vulners: CVE-2026-108917 (CVELIST) vulners.com
- HOL Guard: CVE-2026-108917 hol.org
- Strix AI: CVE-2026-108917 www.strix.ai
- Edimax security notice BR-6208AC V2 www.edimax.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:26.
Original description (NVD)
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.