{"id":"CVE-2026-108918","published":"2026-10-12T18:17:22.353","lastModified":"2026-10-15T14:17:16.050","description":"A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formWlanMP","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108918","tags":[]},{"url":"https://vuldb.com/submit/977200","tags":[]},{"url":"https://vuldb.com/vuln/416730","tags":[]},{"url":"https://vuldb.com/vuln/416730/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_formWlanMP","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in Edimax BR-6208AC router firmware version 1.32, where the 'readE2P' argument in the /goform/formWlanMP endpoint can be manipulated to execute arbitrary commands remotely. This critical flaw allows attackers to gain full control of the affected device.","exploitability":"The vulnerability is highly exploitable with no authentication required, allowing remote command execution through a single HTTP request that manipulates the readE2P parameter in the WLAN management form.","blast_radius":"The impact could be significant across all Edimax BR-6208AC routers running firmware version 1.32, potentially allowing attackers to establish persistent backdoors, exfiltrate data, or use the devices as launch points for further attacks.","remediation":"Upgrade to firmware version 2.590 or later, as this is the first fixed version mentioned in the vulnerability description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","router","command-injection"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:13.348Z"}}