External risk intelligence

Edimax BR-6208AC Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-108918

The vulnerability affects a consumer router, which is commonly deployed as an internet-facing gateway device. Web-based management interfaces on such devices are frequently accessible via the network, and the specific endpoint involved is part of the product's administrative or configuration interface, making it a common target for remote access.

Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in Edimax BR-6208AC routers, specifically related to the handling of the `readE2P` argument in the `/goform/formWlanMP` function, which can lead to command injection. This issue is remotely exploitable and a public exploit is available, though the affected devices are no longer supported by the vendor.

Unauthenticated remote attackers can execute commands.
Unpatched routers are vulnerable to external command execution.
Focus on confirming relevance and exposure for unsupported devices.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target a specific function within the router's web interface by manipulating a parameter. This manipulation allows for command injection, potentially leading to a complete compromise of the device. The exploit is publicly available, and the vulnerability affects unsupported products.

No authentication or user interaction needed.
Manipulate argument in `/goform/formWlanMP`.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in the affected router's WAP configuration interface could allow an unauthenticated remote attacker to inject and execute arbitrary commands. This could occur when the `readE2P` argument is manipulated, potentially leading to unauthorized access or modification of the device's functions and network traffic. The affected products are no longer supported by the maintainer.

Router command execution is at risk.
Remote manipulation of a configuration argument.
Unauthorized network access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Edimax BR-6208AC, being an end-of-life consumer router, likely falls under the purview of home or small business network administrators. Given its unsupported status and the critical nature of the command injection vulnerability, the immediate priority is to locate these devices on the network, assess their exposure, and confirm their business criticality before planning any remediation or mitigation.

Network administrators own this issue.
Verify device reachability and business criticality.
Plan phased remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Edimax BR-6208AC?

The Edimax BR-6208AC is a wireless router designed for home or small office networking environments. It provides connectivity for devices to access the internet and manage local network traffic through a built-in web-based interface. Because it is a network gateway, it sits at the edge of the local area network, bridging internal devices with external services.

What does command injection mean for CVE-2026-108918?

This vulnerability falls under the weakness class of command injection. It means the router fails to properly sanitize user-supplied input—specifically the readE2P argument—before processing it. An attacker can use this flaw to force the device to run unauthorized, malicious commands directly on its operating system, effectively bypassing its intended security controls.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the /goform/formWlanMP endpoint on the router's web interface. No authentication is required to initiate this process, nor does it require any action from a legitimate user. It is important to note that simply visiting the router's management page for standard configuration tasks does not trigger the bug; the attack requires specific manipulation of the argument.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies this as a high-risk scenario because the BR-6208AC acts as an internet-facing gateway. Since the vulnerable component is part of the router's management interface, any device reachable from the public internet is a potential target. Devices that are fully isolated from external network access are less directly exposed to remote triggers, though they remain vulnerable to local network attacks.

What should I do if I am running this router?

Because the manufacturer no longer supports this product, you will not receive security updates to patch the flaw. Your primary step is to verify the device's presence and identify its exposure on your network. Given the critical nature of the vulnerability and the lack of vendor support, the safest practical response is to replace the router with a modern, supported alternative to maintain network security.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.