A vulnerability was found in Edimax BR-6208AC 1.32. (CVE-2026-108916)

The Edimax BR-6208AC router firmware version 1.32 contains a command injection vulnerability in the /goform/formAccept endpoint. An attacker can manipulate the submit-url argument to execute arbitrary commands remotely without requiring authentication. The vendor was notified but did not respond or provide a fix. The vulnerability affects unsupported products only. The CVSS 3.1 base score is 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This can result in loss of confidentiality, integrity, and availability of the device and network traffic passing through it. Since the product is no longer supported, no official fixes or mitigations are available, increasing the risk for affected users.

No official patch or fix is available as the product is no longer supported and the vendor did not respond to disclosure. Users should consider discontinuing use of the affected device or isolating it from untrusted networks to reduce exposure. Monitoring for unusual activity and replacing the device with a supported model is recommended.