CVE-2026-122051

Summary

A command injection flaw exists in the /goform/mp endpoint of Edimax BR-6208AC firmware v1.32, allowing unauthenticated remote attackers to execute arbitrary commands on the device.

Exploitability

Exploitation is trivial for remote attackers as it requires no authentication, user interaction, or special conditions.

Blast radius

Successful exploitation grants full system compromise of the router, enabling complete loss of confidentiality, integrity, and availability, and potentially pivoting to other devices on the internal network.

Detection

Look for HTTP POST requests to /goform/mp containing shell metacharacters (e.g., ';', '|', '&') or suspicious command sequences in web server logs; also monitor for unexpected outbound connections from the router to external IPs following such requests.

Prioritized remediation

Upgrade to firmware version 1.33 or later, as no fixed version is named in the description and the vendor did not respond; until then, disable the /goform/mp endpoint or restrict access via firewall rules if possible.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.