A vulnerability was determined in Edimax BR-6208AC 1.32. (CVE-2026-108917)
Description
A critical command injection vulnerability exists in Edimax BR-6208AC firmware version 1.32. The flaw is triggered via manipulation of the tftpsIP argument in the /goform/formAutoFWupgrade endpoint. This vulnerability can be exploited remotely without authentication. The vendor no longer supports this product and has not responded to disclosure attempts. The exploit has been publicly disclosed, but no patch or fix is available.
CVSS v3.1
Score 10.0critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108917 is a command injection vulnerability in Edimax BR-6208AC version 1.32. It arises from improper processing of the tftpsIP argument in the /goform/formAutoFWupgrade endpoint, allowing remote attackers to execute arbitrary commands. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact. The vendor has not issued a patch and the product is no longer supported. Public exploit details have been disclosed.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary commands on the affected device with full control, leading to complete compromise of confidentiality, integrity, and availability. Given the critical CVSS score and remote attack vector, this vulnerability poses a severe risk to affected devices.
Mitigation Recommendations
No official patch or fix is available as the product is no longer supported and the vendor has not responded to disclosure. Users should consider discontinuing use of the affected device or isolating it from untrusted networks to mitigate risk. Monitor for any vendor updates or community-provided mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jm9w-v357-jj5j
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-108917"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acd55382cdf04f656da8300
Added to database: 10/12/2026, 21:46:32 UTC
Last enriched: 10/12/2026, 21:48:40 UTC
Last updated: 10/13/2026, 03:48:07 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.