CVE-2026-108915 is a remotely exploitable buffer overflow in Edimax BR-6208AC firmware 1.32, rated CVSS 3.1 9.9 (Critical). An exploit has been disclosed publicly, and the product is no longer supported by its maintainer.
What Is It
The flaw is in the /goform/formWlanMP endpoint of the Edimax BR-6208AC. Manipulating the ateBW argument triggers a buffer overflow. The NVD record maps it to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Classic Buffer Overflow).
VulDB, the CNA, published the record on 2026-10-12. Its NVD status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
- Remote attack: The vulnerability can be exploited over the network with low attack complexity and no user interaction.
- Low privileges needed: The CVSS 3.1 vector (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows that low-level privileges are required. Its scope is marked as changed, with high impact to confidentiality, integrity and availability. - Public exploit: The CNA says the exploit has been disclosed publicly and may be used. The CVSS 4.0 vector rates exploit maturity as Proof-of-Concept.
- Scores: CVSS 3.1 is 9.9 (Critical), CVSS 4.0 is 8.6 (High) and CVSS 2.0 is 9.0.
- Not in CISA KEV: CISA's Known Exploited Vulnerabilities catalog has no entry for this CVE, so KEV does not confirm active exploitation in the wild.
What's Vulnerable
| Vendor | Product | Version | Status |
|---|---|---|---|
| Edimax | BR-6208AC | 1.32 | Affected |
- CPE:
cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:* - CVE tag:
unsupported-when-assigned. The product was already out of support when the CVE was assigned.
Patch Status
- No patch: The CNA says it contacted Edimax early about the disclosure and the vendor did not respond. The source material lists no fix or vendor advisory.
- No CISA deadline: There is no KEV entry, so CISA has issued no required action or due date.
- No support: The vulnerability affects only products that are no longer supported by the maintainer, so a firmware fix is unlikely. Owners of BR-6208AC devices running firmware 1.32 should treat them as permanently vulnerable. Limit network access to their management interface, or replace them with a supported device.