CVE-2026-108933: Cross Site Scripting in Edimax BR-6208AC

This vulnerability affects Edimax BR-6208AC firmware version 1.32. It is a cross-site scripting (XSS) issue in an unknown function of the /goform/formFilter file. The vulnerability can be exploited remotely without user interaction but requires high privileges. Exploit code is publicly available. The vendor was contacted but did not respond, and no patch or mitigation guidance has been provided.

Successful exploitation could allow an attacker with high privileges to execute cross-site scripting attacks remotely, potentially leading to session hijacking or other client-side attacks. However, the vulnerability requires high privileges and user interaction, which limits the impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should limit access to the affected device's management interface and monitor for suspicious activity. Avoid exposing the device management interface to untrusted networks until a fix is released.