{"id":"CVE-2026-116227","kind":"vulnerability","aliases":["CVE-2026-116227"],"related":[],"title":"Edimax BR-6208AC router: Virtual Server page allows cross-site scripting","description":"A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The Virtual Server configuration page in Edimax BR-6208AC firmware 1.32 fails to sanitize input, so crafted input can inject script. An attacker who gets a user to open a malicious link could run script in the router admin session.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["br-6208ac","edimax","infrastructure","routers","self-hosted"],"not_affected_if":["different-model","patched-firmware"],"how_to_check":"- Check the router's firmware version in its admin interface under status or system information; `1.32` is the affected version per the sources.\n- unknown for further detection steps; the sources do not say which parameter or request is affected.","fix":"- unknown: the sources report the vendor did not respond and do not name a patched firmware version.\n- Restrict router admin access to the local network and do not browse while logged into the admin interface, as a practical mitigation.","status":"open","published_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","triaged_at":"2026-10-26T07:30:02+00:00","updated_at":"2026-10-26T07:30:02+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T07:30:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources report the vendor did not respond and do not name a patched firmware version.\n- Restrict router admin access to the local network and do not browse while logged into the admin interface, as a practical mitigation.","reach":"network","title":"Edimax BR-6208AC router: Virtual Server page allows cross-site scripting","impact":"low","summary":"The Virtual Server configuration page in Edimax BR-6208AC firmware 1.32 fails to sanitize input, so crafted input can inject script. An attacker who gets a user to open a malicious link could run script in the router admin session.","category":"infrastructure","nicknames":[],"who_cares":["edimax","br-6208ac","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Script runs in the router admin session, enabling config changes.","analyst_note":"Confirm the affected parameter, whether login is required, and whether any firmware fix exists at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-116227 or vendor advisories.","how_to_check":"- Check the router's firmware version in its admin interface under status or system information; `1.32` is the affected version per the sources.\n- unknown for further detection steps; the sources do not say which parameter or request is affected.","needs_analyst":true,"not_affected_if":["different-model","patched-firmware"],"who_is_affected":"Owners of Edimax BR-6208AC routers running firmware 1.32 are exposed, most relevant where the admin interface is reachable from untrusted networks or where an admin browses while logged in. Teams that do not run this model can skip it. The sources do not state whether default configuration is affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":3326,"output_tokens":616,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-116227':16A,19A '-2026':15A,18A '1.32':40B,80C '6208ac':4A,22B,38B,79C 'admin':68B 'affect':83C 'allow':9A 'attack':52B,103C 'br':3A,21B,37B,78C 'br-6208ac':2A,20B,36B,77C 'code':85C 'compon':88C 'configur':32B 'contact':121C 'could':62B 'craft':46B 'cross':11A,96C 'cross-sit':10A 'cve':14A,17A 'disclos':110C 'disclosur':125C 'earli':122C 'edimax':1A,23B,35B,76C 'exploit':100C,107C 'fail':41B 'firmwar':39B 'found':74C 'get':54B 'host':28B 'infrastructur':24B 'inject':49B 'input':44B,47B 'lead':94C 'link':61B 'malici':60B 'manipul':93C 'may':115C 'open':58B 'page':8A,33B,91C 'possibl':105C 'public':113C 'remot':99C 'respond':129C 'router':5A,25B,67B 'run':63B 'sanit':43B 'script':13A,50B,64B,98C 'self':27B 'self-host':26B 'server':7A,31B,90C 'session':69B 'site':12A,97C 'unknown':84C 'use':117C 'user':56B 'vendor':119C 'virtual':6A,30B,89C 'vulner':71C,82C 'way':132C","nicknames":[],"mitigations":[],"who_affected":"Owners of Edimax BR-6208AC routers running firmware 1.32 are exposed, most relevant where the admin interface is reachable from untrusted networks or where an admin browses while logged in. Teams that do not run this model can skip it. The sources do not state whether default configuration is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T07:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116227","severity":null,"published_at":"2026-10-26T07:17:09+00:00","modified_at":"2026-10-26T07:17:09+00:00","first_seen_at":"2026-10-26T07:28:50+00:00","fetched_at":"2026-10-26T07:28:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}