CVE-2026-108917

Summary

A command injection vulnerability exists in Edimax BR-6208AC router firmware version 1.32, allowing remote attackers to execute arbitrary commands through manipulation of the tftpsIP parameter in the /goform/formAutoFWupgrade endpoint. This critical flaw enables full system compromise without authentication.

Exploitability

The vulnerability is highly exploitable with no authentication required, allowing remote command injection through a single parameter manipulation that can be triggered via HTTP requests to the affected endpoint.

Blast radius

If exploited, this vulnerability could allow attackers to gain complete control over affected routers, potentially enabling them to establish persistent backdoors, redirect traffic, or use the devices as launch points for further attacks on internal networks.

Detection

Monitor network traffic for HTTP POST requests to /goform/formAutoFWupgrade with suspicious tftpsIP parameter values that contain shell metacharacters like semicolons, pipes, or command substitutions, and check for unusual outbound connections from affected routers.

Prioritized remediation

Upgrade to firmware version 2.590 or later, as this is the first fixed version mentioned in the vendor's advisory for the BR-6208AC model.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.