{"id":"CVE-2026-108914","published":"2026-10-12T17:17:13.890","lastModified":"2026-10-15T14:17:15.850","description":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-120"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/BufferOverflow_formWlSiteSurvey","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108914","tags":[]},{"url":"https://vuldb.com/submit/977194","tags":[]},{"url":"https://vuldb.com/vuln/416726","tags":[]},{"url":"https://vuldb.com/vuln/416726/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/BufferOverflow_formWlSiteSurvey","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer overflow vulnerability in Edimax BR-6208AC router firmware version 1.32 allows remote attackers to execute arbitrary code through manipulation of the 'ifname' argument in the /goform/formWlSiteSurvey endpoint. This critical flaw enables remote code execution with high impact.","exploitability":"Exploitation is relatively straightforward as it's a remote buffer overflow with no user interaction required, though it may need specific network conditions to reach the vulnerable device.","blast_radius":"The vulnerability affects all unsupported Edimax BR-6208AC routers running firmware version 1.32, potentially allowing attackers to gain full control of these devices remotely.","remediation":"Upgrade to firmware version 2.590 or later immediately, as this is the first fixed version mentioned in the vulnerability description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","remote","embedded"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:18.300Z"}}