Edimax BR-6208AC: Command injection in formWlanMP
Summary
The web management endpoint /goform/formWlanMP of the Edimax BR-6208AC router firmware 1.32 does not properly neutralize the readE2P parameter, which is passed to a system command. An attacker who can reach the endpoint over the network may be able to execute arbitrary operating system commands on the device and take full control of it. A public proof of concept exists. The product is end-of-life and no fix is available; the CVE record does not state whether authentication is required.
Affected
- Edimax BR-6208AC, firmware BR-6208AC_1.32
- Hardware variant (V1 or V2) for this firmware is not confirmed.
Fixed in
Unknown. No patched firmware is known. The vendor has stated that it no longer develops firmware or security patches for this model.
Workaround
- Remove WAN access to the web management interface and disable remote management.
- Restrict LAN access to the admin page to trusted hosts.
These measures reduce exposure but do not fix the vulnerability.
Exploitation
- Public proof of concept available (VulDB status: Proof-of-Concept).
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation poc, automatable yes, technical impact total.
- EPSS about 0.02.
Our recommendation
- Identify all units of this model and check whether the admin interface is reachable from the internet.
- Disconnect or isolate affected units from untrusted networks and disable remote management immediately.
- Plan replacement with a supported device; no patch will be released.
- Monitor the router for unexpected outbound connections and configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-108918 vuldb.com
- VulDB vulnerability 416730 vuldb.com
- GitHub write-up RCE_formWlanMP github.com
- Edimax security notice BR-6208AC V2 (end-of-life) www.edimax.com
- OpenCVE CVE-2026-108918 app.opencve.io
- HOL Guard CVE-2026-108918 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:27.
Original description (NVD)
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.