External risk intelligence

Edimax BR-6208AC Remote Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-122051

The affected product is an internet-facing consumer wireless router. The vulnerability exists in a web management interface component (/goform/mp), which is typically exposed to the network to facilitate device configuration and is often reachable from the public internet in common home and small office deployment patterns.

Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in Edimax BR-6208AC devices, allowing for remote exploitation. The vulnerability resides within an unknown function accessed via the `/goform/mp` file, and has a published exploit available, raising concerns about potential misuse. The vendor has not responded to the disclosure.

Remote attackers can inject commands.
Critical flaw in widely used router technology.
Confirm relevance and exposure for devices.

Attack Path

How an attacker could exploit the issue

An attacker can remotely reach a web management interface on the affected router and send specially crafted input to a specific file. This manipulation targets an unknown functionality, which can then be tricked into executing arbitrary commands on the router.

Reachable via the internet.
Manipulating the `/goform/mp` file.
Command injection leading to full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A command injection vulnerability in the /goform/mp file of the Edimax BR-6208AC could allow an attacker to execute arbitrary commands on the device. This risk is elevated because the exploit has been published and the vendor has not responded to inquiries.

System commands and device control.
Remote manipulation via a web interface.
Complete device compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the vulnerability in the Edimax BR-6208AC router's web management interface, the platform or infrastructure team is likely responsible for initial identification and triage, followed by coordination with network and security teams. The first practical step is to determine the reachability and criticality of affected devices. This process may involve working with vendor management if the devices are managed through a third party.

Platform/Infrastructure teams should own the issue.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Edimax BR-6208AC?

The Edimax BR-6208AC is a consumer wireless router designed to provide home and small office network connectivity. It serves as a gateway for internet traffic, managing how devices communicate across both wired and wireless connections. Because it handles network routing, it includes a web-based management interface that allows users to configure settings, firewall rules, and wireless access preferences directly through a browser.

What is the vulnerability in CVE-2026-122051?

This CVE involves a command injection flaw, specifically categorized under CWE-74 and CWE-77. In plain terms, the router's web management interface fails to properly filter user input before processing it. An attacker can supply specially crafted data to the '/goform/mp' file, tricking the device into executing unauthorized system commands. This effectively allows an attacker to run their own code with the same privileges as the router's operating system.

How does an attacker trigger this command injection?

An attacker triggers this flaw by sending a manipulated request to the '/goform/mp' file on the router's web interface. This does not require local physical access to the hardware. It is important to note that sending standard, legitimate configuration requests to the device will not trigger the bug; the vulnerability is specifically activated only when malicious, crafted input is sent to that specific file location to force command execution.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is considered highly relevant because the affected component is typically internet-facing. Since this router is designed for home and small office use, its management interface is often reachable from the public internet by default or through common configuration patterns. If your device is accessible from the outside, the risk of remote compromise is significantly higher.

What steps should I take if I use this router?

Since there is currently no vendor response or fix, prioritize limiting access to the device. Check your network configuration to ensure the web management interface is not exposed to the public internet. If possible, restrict management access to only trusted, internal devices or disable remote administration features entirely. Monitor your network for unusual traffic patterns, as the lack of a vendor patch makes containment through network isolation your primary defense.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.