Edimax BR-6208AC 1.32 Exposes Remote Command Injection via Firmware Upgrade Form

A critical remote code injection vulnerability has been identified in Edimax BR-6208AC firmware version 1.32, according to the National Vulnerability Database record for CVE-2026-108917. The issue stems from improper processing of the /goform/formAutoFWupgrade endpoint. Attackers can exploit this by manipulating the tftpsIP argument to inject and execute arbitrary system commands. The attack can be performed remotely, allowing exploitation without local access.

The risk

The National Vulnerability Database assigns this vulnerability a CVSS score of 10, rating it as critical. The underlying weaknesses are classified as CWE-77 and CWE-74, indicating improper neutralization of special elements in output and command injection. Public disclosure of the exploit method means the technique is available for malicious use. The vulnerability allows for direct command execution on the device, posing a severe threat to the integrity and availability of the network hardware.

Who is exposed

Only devices running Edimax BR-6208AC firmware version 1.32 are affected by this specific vulnerability. The National Vulnerability Database notes that this product is no longer supported by its maintainer. Organizations that have retained this specific router model and firmware version in their infrastructure remain exposed. No other Edimax products or firmware versions are mentioned in the vulnerability record as being impacted by this specific flaw.

Cost and compliance

The lack of vendor response creates significant operational uncertainty for affected businesses. The National Vulnerability Database states that the vendor was contacted early about the disclosure but did not respond in any way. Because the product is unsupported, there is no confirmed patch or update available to remediate the issue. Businesses must rely on isolation or replacement strategies to mitigate the risk, as no official fix has been released or promised by the manufacturer.

What to watch

Business leaders should verify if any Edimax BR-6208AC units are still in active use, particularly those running version 1.32. Since no patch is available, the primary mitigation is removing the device from the network or isolating it from untrusted traffic. Monitoring for unusual outbound traffic or command execution logs on the router can help detect exploitation attempts before full compromise occurs.

What to do and how to stay safe: Edimax

• Inventory all network hardware to identify any Edimax BR-6208AC routers running firmware version 1.32.
• Isolate affected devices from the internet and untrusted networks immediately, as no patch is available.
• Replace unsupported hardware with currently supported models that receive regular security updates.
• Monitor network logs for unauthorized access attempts to the /goform/formAutoFWupgrade endpoint.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there a patch for Edimax BR-6208AC 1.32?

No, the vendor has not responded to disclosure and no fix has been confirmed.

What is the CVSS score for CVE-2026-108917?

The National Vulnerability Database rates it as 10, which is critical.

Which endpoint is vulnerable?

The /goform/formAutoFWupgrade file is vulnerable to command injection via the tftpsIP argument.