Key points
- CVE-2026-108917 affects Edimax BR-6208AC running firmware version 1.32.
- The vulnerability enables remote command injection via the tftpsIP argument in the auto-update form.
- No vendor response or patch has been confirmed for this unsupported product.
The National Vulnerability Database recorded CVE-2026-108917 as a critical severity issue affecting Edimax BR-6208AC devices running firmware version 1.32. This flaw allows remote attackers to inject commands through the automatic firmware upgrade processing function.
Security researchers identified that manipulating the tftpsIP argument within the /goform/formAutoFWupgrade endpoint leads to command injection. This weakness maps to CWE-77 and CWE-74 classifications. Attackers can perform the attack from a remote location.
Risk Assessment
The exploit code for this vulnerability has been publicly disclosed and may be utilized. According to the NVD record, the issue was reported to the vendor early in the disclosure process. Edimax did not respond to these initial contact attempts.
That suggests organizations relying on this specific firmware version face immediate risk. The lack of vendor engagement means no official mitigation or patch timeline exists. Administrators must assume the flaw remains active and potentially exploitable.
Affected Systems
This vulnerability only impacts Edimax BR-6208AC products running firmware version 1.32. The NVD explicitly states that this version is no longer supported by the maintainer. Devices running other firmware versions or different Edimax models are not listed as affected in this record.
System administrators should verify the exact firmware version on their network infrastructure. The BR-6208AC is a product from Edimax. Its status as unsupported hardware complicates long-term risk management strategies for organizations using this specific model.
Next steps
Organizations should inventory all Edimax BR-6208AC units currently in operation. Check the firmware version against the affected list provided in the CVE record. If version 1.32 is detected, treat the device as vulnerable until isolated or replaced.
Monitor network traffic for unusual activity from these devices. Since the exploit is public, automated scanning tools may target this specific endpoint. Document the exposure for compliance and audit purposes, noting the lack of vendor support.
What to do and how to stay safe: Edimax
- Isolate affected Edimax BR-6208AC devices from the main network to prevent potential compromise.
- Block inbound traffic to the firmware upgrade port if remote management is not required.
- Plan for hardware replacement with a supported vendor that provides regular security updates.
- Review logs for unauthorized access attempts to the /goform/formAutoFWupgrade endpoint.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for CVE-2026-108917?
No, the vendor did not respond to disclosure efforts and the product is no longer supported.
How is the vulnerability exploited?
By manipulating the tftpsIP argument in the automatic firmware upgrade form on the device.
What is the CVSS score for this flaw?
The National Vulnerability Database rates it as critical with a CVSS score of 10.
