CVE-2026-108914 is a critical buffer overflow in Edimax BR-6208AC firmware 1.32 that can be exploited remotely. Its maintainer no longer supports the product.
What Is It
CVE-2026-108914 is a buffer overflow in the /goform/formWlSiteSurvey endpoint of the Edimax BR-6208AC. VulDB, the CNA, says an attacker triggers the flaw by manipulating the ifname argument. It is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-120 (classic buffer overflow).
NVD published the record on 2026-10-12. Its status is "Received," which means NVD has not yet finished its own analysis.
Why It Matters
The CNA rates the flaw CVSS 3.1 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- The attack can be launched over the network.
- Attack complexity is low.
- The attacker needs low privileges.
- No user interaction is required.
- Impact on confidentiality, integrity and availability is high, and the scope is changed.
The CVSS 4.0 score is 8.6 (High), with exploit maturity rated as Proof of Concept. The CVSS 2.0 score is 9.0.
According to the advisory, the exploit has been published and may be used. A public write-up is linked in the sources below.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: Edimax
- Product: BR-6208AC
- Affected version: 1.32
- CPE:
cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
The CVE carries the CNA tag unsupported-when-assigned. The description says the vulnerability affects only products that the maintainer no longer supports.
Patch Status
There is no patch and no vendor advisory. The disclosure says Edimax was contacted early but did not respond. The product is unsupported and the vendor has not engaged, so owners should not plan around a firmware fix.
There is no KEV entry, so no CISA required action or due date applies. Organizations still running the BR-6208AC on firmware 1.32 should treat the device as unpatched for good. They should replace it with supported hardware. Until then, they should limit who can reach the management interface.