CVE-2026-108936 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router version 1.32. The vulnerability exists in the /goform/formQoS component of the QoS Page and can be exploited remotely. The vendor has not responded to the disclosure. The CVSS score is 4.8, indicating a medium severity level.
CVE-2026-108935 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router firmware version 1.32. The flaw exists in the Port Forwarding Page component, specifically in the /goform/formPortFw file. An attacker can remotely exploit this vulnerability to execute malicious scripts. The vendor was contacted but did not respond, and no patch or remediation information is available. The vulnerability has a CVSS 4.8 (medium) severity score.
A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-108933 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router firmware version 1.32. The vulnerability exists in an unspecified function within the /goform/formFilter file. It allows remote attackers to execute XSS attacks. The vendor was notified but has not responded or provided a fix. Exploit code is publicly available, but no active exploitation in the wild has been reported. The CVSS 4.0 base score is 4.8, indicating a medium severity.
CVE-2026-108918 is a critical command injection vulnerability in the Edimax BR-6208AC router, version 1.32. The flaw exists in an unspecified function within the /goform/formWlanMP file, where manipulation of the readE2P argument allows remote attackers to execute arbitrary commands. Exploit code is publicly available. The affected product is no longer supported by the vendor, and no response or patch has been provided.
CVE-2026-108917 is a critical command injection vulnerability in Edimax BR-6208AC version 1.32. It arises from improper processing of the /goform/formAutoFWupgrade endpoint, specifically the tftpsIP argument, allowing remote attackers to execute arbitrary commands. The vulnerability affects an unsupported product version, and the vendor has not responded to disclosure attempts. Public exploit code is available, but no known active exploitation has been reported.
CVE-2026-108916 is a command injection vulnerability in Edimax BR-6208AC version 1.32. It occurs via manipulation of the submit-url argument in the /goform/formAccept endpoint. The vulnerability can be exploited remotely without authentication. The affected product is no longer supported by the vendor, and no patch or vendor response has been provided. Public exploit code exists but there are no known exploits in the wild.
CVE-2026-108915 is a critical buffer overflow vulnerability in Edimax BR-6208AC version 1.32. It occurs due to improper handling of the argument ateBW in the /goform/formWlanMP file. The vulnerability can be exploited remotely without user interaction. The affected product is no longer supported by the vendor, and no patch or vendor response is available. Public exploit code has been disclosed.
CVE-2026-108914 is a critical buffer overflow vulnerability in the Edimax BR-6208AC router firmware version 1.32. The flaw exists in the /goform/formWlSiteSurvey functionality where manipulation of the 'ifname' argument leads to a buffer overflow. This vulnerability is remotely exploitable without user interaction and has a published exploit. The affected product is no longer supported by the vendor, and no patch or vendor response has been provided.
A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-82703 is an OS command injection vulnerability in the Edimax BR-6214K router version 1.40. The flaw exists in the system function of the www/ping.asp file, specifically in the asp_setPing endpoint, where manipulation of the pingstr argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable and public exploit code is available. The vendor has not responded or provided a fix.
CVE-2026-82702 is a medium severity OS command injection vulnerability in the Edimax BR-6214K router version 1.40. The flaw exists in the system function of the www/wlanMP.asp file within the asp_WlanMP Endpoint component, where manipulation of the ateFunc argument allows remote attackers to execute arbitrary OS commands. The vendor has not responded to disclosure requests, and no official patch or remediation guidance is currently available. Exploit code is publicly available, but no known exploitation in the wild has been reported.
CVE-2026-19963 is a command injection vulnerability in the Edimax EW-7478APC device, specifically in version 1.04. The flaw exists in the stainfo function of the /goform/stainfo file, where manipulation of the interface argument allows remote attackers to execute arbitrary commands. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. No official patch or remediation is currently available.
A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-19961 is a critical buffer overflow vulnerability in the Edimax EW-7478APC wireless access point firmware version 1.04. The flaw exists in the formWlSiteSurvey function, where manipulation of the selSSID argument can cause a buffer overflow. This vulnerability can be exploited remotely without user interaction. The vendor has not responded to disclosure requests, and no official patch or remediation guidance is currently available. Exploit code is publicly available, increasing the risk of exploitation.
A security vulnerability has been detected in Edimax EW-7478APC 1.04. This impacts the function formWlbasic of the file /goform/formWlbasic. Such manipulation of the argument rootAPmac leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. Such manipulation of the argument ShareName/SelectName leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. This manipulation of the argument UserName/Password causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Edimax EW-7478APC 1.04. This vulnerability affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component POST Request Handler. The manipulation of the argument rootAPmac results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.