CVE-2026-108918 is a critical (CVSS 3.1 10.0) remote command injection flaw in Edimax BR-6208AC firmware 1.32. The exploit is public, and the product is no longer supported by its maintainer.
What Is It
CVE-2026-108918 is a command injection vulnerability in the Edimax BR-6208AC router. It affects an unspecified function in the file /goform/formWlanMP. Manipulating the readE2P argument leads to command injection, and the attack can be launched remotely. The weakness is classified as CWE-74 (Injection) and CWE-77 (Command Injection).
VulDB assigned the CVE and published it on October 12, 2026. NVD lists its status as "Received," which means NVD has not yet analyzed it.
Why It Matters
The CNA scored the flaw at the top of the severity range:
- CVSS 3.1: 10.0 Critical (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It can be exploited over the network with low complexity, no privileges and no user interaction. The scope is changed, and the impact on confidentiality, integrity and availability is high. - CVSS 4.0: 9.3 Critical, with exploit maturity rated as Proof-of-Concept.
- CVSS 2.0: 10.0.
According to the CVE description, the exploit is publicly available and might be used. A third-party write-up is linked in the references.
This CVE is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. A public exploit combined with unauthenticated network access still makes exposed devices easy targets.
What's Vulnerable
- Vendor: Edimax
- Product: BR-6208AC
- Affected version: 1.32
- CPE:
cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
The CVE carries the unsupported-when-assigned tag, which means the product was already out of support when the CVE was assigned.
Patch Status
No patch or fixed version is listed. The disclosure says the vendor was contacted early but did not respond. The vulnerability only affects products that are no longer supported by the maintainer, so a vendor fix is unlikely.
The source data includes no CISA required action or remediation deadline, because the CVE has no KEV entry.