A critical command injection flaw in firmware 1.32 of the Edimax BR-6208AC router can be triggered remotely without credentials, a public exploit is out, and the vendor has not responded to the disclosure.
What Is It
CVE-2026-122051 is a command injection vulnerability in the Edimax BR-6208AC router running firmware version 1.32. It sits in an unnamed function of the /goform/mp endpoint. A crafted request to that endpoint can lead to command injection, and the attack can be launched remotely. The weakness is classified as CWE-74 (Injection) and CWE-77 (Command Injection).
VulDB is the CNA that published the CVE record. NVD lists the record as "Deferred."
Why It Matters
The flaw is rated CRITICAL under every scoring version listed, with a maximum score under CVSS 3.1 and CVSS 2.0:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
The vectors show it can be reached over the network with low complexity. It needs no privileges and no user interaction. Confidentiality, integrity and availability impacts are all rated high, and the CVSS 3.1 scope is "Changed." That means a successful attack can affect systems beyond the vulnerable component.
The exploit has been published and may be used, and a public write-up appears in the references. As of this writing, CVE-2026-122051 does not appear in CISA's Known Exploited Vulnerabilities (KEV) catalog, so active exploitation in the wild is not confirmed.
What's Vulnerable
- Vendor: Edimax
- Product: BR-6208AC
- Affected version: Firmware 1.32
- CPE:
cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
The source data lists no other firmware versions as affected or unaffected.
Patch Status
No patch or vendor advisory is listed. According to the CVE description, the vendor was contacted early about the disclosure but did not respond. There is no KEV entry, so no CISA-mandated remediation or due date applies.
The available sources describe no official fix. Organizations running BR-6208AC devices on firmware 1.32 should treat them as exposed to unauthenticated remote attack. They should also check the referenced VulDB entries for updates.