CVE-2026-108917 is a critical command injection flaw in Edimax BR-6208AC firmware 1.32. It can be exploited remotely, an exploit has been publicly disclosed, and the vendor has not responded.
What Is It
CVE-2026-108917 is a command injection vulnerability in the Edimax BR-6208AC router running firmware version 1.32. It sits in the handling of the /goform/formAutoFWupgrade endpoint. An attacker who manipulates the tftpsIP argument can inject commands. The CNA (VulDB) maps the issue to CWE-74 (Injection) and CWE-77 (Command Injection).
NVD published the record on 2026-10-12. Its status is currently "Received", which means NVD has not yet completed its own analysis.
Why It Matters
- Severity: VulDB scores the flaw CVSS 3.1 10.0 (CRITICAL) with vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Its CVSS 4.0 score is 9.3 (CRITICAL). - Exploitability: An attacker can exploit it remotely over the network with low complexity, no privileges and no user interaction.
- Public exploit: According to the description, the exploit "has been publicly disclosed and may be utilized." The CVSS 4.0 data rates exploit maturity as Proof-of-Concept.
- Exploitation status: None of the sources cited here report confirmed in-the-wild exploitation or a listing in the CISA Known Exploited Vulnerabilities (KEV) catalog. Defenders should check the KEV catalog directly for current status.
- Impact: Confidentiality, integrity and availability impacts are all rated High. The scope is "Changed", so a successful attack can affect resources beyond the vulnerable component.
What's Vulnerable
- Vendor: Edimax
- Product: BR-6208AC
- Affected version: 1.32
- CPE:
cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
The CVE carries the tag "unsupported-when-assigned." According to the description, the vulnerability affects only products the maintainer no longer supports.
Patch Status
The source material does not reference any patch. The description says the vendor was contacted early about the disclosure but "did not respond in any way." The product is end-of-support, so organizations should not count on a fix. Owners of BR-6208AC devices running 1.32 should treat them as permanently unpatched and plan to retire them.