A vulnerability was identified in Edimax BR-6208AC 1.32. (CVE-2026-108918)

CVE-2026-108918 is a command injection vulnerability in Edimax BR-6208AC version 1.32. The vulnerability arises from improper handling of the readE2P argument in a function accessed via the /goform/formWlanMP endpoint. This allows remote attackers to inject and execute arbitrary commands on the device. The exploit is publicly available, increasing the risk of exploitation. The vendor was notified but did not respond, and the product is no longer maintained or supported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands with the privileges of the affected device, leading to full compromise (confidentiality, integrity, and availability impact). Given the CVSS 3.1 score of 10.0, this is a critical vulnerability with severe consequences for affected devices.

No official patch or remediation is available as the vendor has not responded and the product is no longer supported. Users should consider discontinuing use of the affected device or isolating it from untrusted networks to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance if it becomes available.