Key points
- CVE-2026-108918 affects Edimax BR-6208AC firmware version 1.32.
- The flaw enables remote command injection through the /goform/formWlanMP endpoint.
- No vendor patch exists because the product is no longer supported.
Users of the Edimax BR-6208AC router running firmware version 1.32 face immediate risk from a critical security flaw. The National Vulnerability Database lists CVE-2026-108918 with a maximum severity score. Attackers can exploit this issue remotely without needing prior access to the device or network credentials.
The vulnerability stems from improper handling of input in a specific web interface function. According to the NVD record, manipulating the readE2P argument in the /goform/formWlanMP file leads to command injection. This allows an attacker to run arbitrary commands on the device.
What we know
The National Vulnerability Database classifies CVE-2026-108918 as critical, assigning it a CVSS score of 10. This rating reflects the severity assigned by the database. The weakness involves both OS command injection and incorrect handling of special elements, mapped to CWE-77 and CWE-74.
The exploit code for this vulnerability is publicly available online. The NVD record notes that this public availability means the exploit might be used. Because the exploit is accessible, the risk of abuse is present.
Edimax was contacted early regarding this disclosure but did not respond. The NVD record explicitly states that this vulnerability only affects products that are no longer supported by the maintainer. Consequently, no security update or patch has been confirmed for firmware version 1.32.
Defender's checklist
- Identify all Edimax BR-6208AC devices on your network.
- Verify if the device is running firmware version 1.32.
- Check if the device is exposed to the public internet.
- Review firewall logs for unusual traffic to the formWlanMP endpoint.
What to do and how to stay safe: Edimax
- Isolate affected routers from the internet by disabling WAN ports.
- Block inbound traffic to the device's web management interface.
- Monitor network traffic for signs of remote command execution attempts.
- Replace unsupported hardware with a model that receives security updates.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for CVE-2026-108918?
No patch has been confirmed. The NVD record states the product is no longer supported by the maintainer.
Can this vulnerability be exploited remotely?
Yes, the NVD record confirms it is possible to initiate the attack remotely.
Which firmware version is affected?
Only Edimax BR-6208AC firmware version 1.32 is listed as affected.
