{"id":"CVE-2026-108917","published":"2026-10-12T18:17:22.163","lastModified":"2026-10-13T17:17:22.140","description":"A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formAutoFWupgrade","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108917","tags":[]},{"url":"https://vuldb.com/submit/977199","tags":[]},{"url":"https://vuldb.com/vuln/416729","tags":[]},{"url":"https://vuldb.com/vuln/416729/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formAutoFWupgrade","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in Edimax BR-6208AC router firmware version 1.32, allowing remote attackers to execute arbitrary commands through manipulation of the tftpsIP parameter in the /goform/formAutoFWupgrade endpoint. This critical flaw enables full system compromise without authentication.","exploitability":"The vulnerability is highly exploitable with no authentication required, allowing remote command injection through a single parameter manipulation that can be triggered via HTTP requests to the affected endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to gain complete control over affected routers, potentially enabling them to establish persistent backdoors, redirect traffic, or use the devices as launch points for further attacks on internal networks.","remediation":"Upgrade to firmware version 2.590 or later, as this is the first fixed version mentioned in the vendor's advisory for the BR-6208AC model.","detection":"Monitor network traffic for HTTP POST requests to /goform/formAutoFWupgrade with suspicious tftpsIP parameter values that contain shell metacharacters like semicolons, pipes, or command substitutions, and check for unusual outbound connections from affected routers.","tags":["rce","web","remote","firmware"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:07.047Z"}}