CVE-2026-108936: Cross Site Scripting in Edimax BR-6208AC

This vulnerability in Edimax BR-6208AC version 1.32 involves a cross-site scripting (XSS) issue in the QoS Page component at /goform/formQoS. An attacker can remotely exploit this flaw to inject malicious scripts, potentially affecting users who access the vulnerable interface. The vendor was notified but has not issued a patch or mitigation guidance. The vulnerability has been publicly disclosed, increasing the risk of exploitation.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, which may lead to the execution of arbitrary scripts in the context of the affected device's web interface. This could potentially result in session hijacking or unauthorized actions performed by an authenticated user. The CVSS score of 4.8 reflects a medium impact with low attack complexity but requiring some privileges and user interaction.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation, users should consider limiting access to the device's web interface to trusted networks only and monitor for any suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.