CVE-2026-108934: Cross Site Scripting in Edimax BR-6208AC
Description
CVE-2026-108934 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router version 1.32. The flaw exists in an unspecified functionality of the /goform/formUrlb file related to the HTTP Blocking Page component. This vulnerability can be exploited remotely and requires user interaction. The vendor has not responded to disclosure attempts, and a public exploit is available. The CVSS 4.0 base score is 4.8, indicating medium severity.
CVSS v4.0
Score 4.8medium
Affected software
Edimax
BR-6208AC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects Edimax BR-6208AC firmware version 1.32. It involves a cross-site scripting issue in the /goform/formUrlb endpoint of the HTTP Blocking Page component. An attacker can remotely manipulate this endpoint to execute XSS attacks, which require user interaction and high privileges. The vulnerability has been publicly disclosed with an exploit available, but the vendor has not issued any response or patch.
Potential Impact
Successful exploitation allows an attacker to perform cross-site scripting attacks remotely, potentially leading to the execution of malicious scripts in the context of the affected device's web interface. This could result in session hijacking, unauthorized actions, or information disclosure within the administrative interface. However, exploitation requires user interaction and high privileges, limiting the impact severity to medium.
Mitigation Recommendations
No official patch or fix is currently available as the vendor has not responded to the disclosure. Users should exercise caution when interacting with the affected device's web interface and consider limiting access to trusted networks. Monitor vendor channels for any future advisories or patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-10-11T18:22:24.954Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd5cd82cdf04f656dece6d
Added to database: 10/12/2026, 22:19:04 UTC
Last enriched: 10/12/2026, 22:33:18 UTC
Last updated: 10/12/2026, 22:33:18 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.