Remote Code Execution in Edimax BR-6208AC via Buffer Overflow

A critical buffer overflow vulnerability has been identified in the Edimax BR-6208AC router running firmware version 1.32. The vulnerability resides within the /goform/formWlSiteSurvey handler, where improper sanitization of the ifname argument allows an unauthenticated, remote attacker to trigger a buffer overflow. This flaw can be leveraged to achieve remote code execution on the affected network device. The vulnerability is publicly documented with available exploit code. Because the Edimax BR-6208AC is an end-of-life product, the vendor has not provided a security patch, leaving devices permanently exposed to this vector. Defenders should prioritize isolating these legacy devices from the internet or replacing them, as they cannot be secured against this specific exploit.

Impact

The vulnerability poses a severe risk of unauthorized remote control over network infrastructure. As the device serves as a perimeter gateway, successful exploitation could lead to full system compromise, traffic interception, or the device being utilized as an entry point for lateral movement into the internal network. Since the product is end-of-life and unsupported, there is no path to remediation through official firmware updates.

Recommendation

1. Inventory and identify all Edimax BR-6208AC devices within the network environment.
2. Implement strict access control lists on edge firewalls to block external traffic directed at the web management interfaces of identified routers.
3. Decommission and replace end-of-life hardware that is confirmed to be affected by CVE-2026-108914.
4. Monitor network traffic for HTTP POST or GET requests targeting the /goform/formWlSiteSurvey URI, which may indicate exploitation attempts.