CVE-2026-108918

Summary

A command injection vulnerability exists in Edimax BR-6208AC router firmware version 1.32, where the 'readE2P' argument in the /goform/formWlanMP endpoint can be manipulated to execute arbitrary commands remotely. This critical flaw allows attackers to gain full control of the affected device.

Exploitability

The vulnerability is highly exploitable with no authentication required, allowing remote command execution through a single HTTP request that manipulates the readE2P parameter in the WLAN management form.

Blast radius

The impact could be significant across all Edimax BR-6208AC routers running firmware version 1.32, potentially allowing attackers to establish persistent backdoors, exfiltrate data, or use the devices as launch points for further attacks.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 2.590 or later, as this is the first fixed version mentioned in the vulnerability description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.