{"id":"CVE-2026-122051","kind":"vulnerability","aliases":["CVE-2026-122051"],"related":[],"title":"Edimax BR-6208AC router: remote command injection via /goform/mp","description":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Edimax BR-6208AC firmware 1.32 has a flaw in the /goform/mp web endpoint that allows command injection. A remote attacker who sends a crafted request can run commands on the router, and a public exploit has been published.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BR-6208AC","fixed":[],"affected":"firmware 1.32","ecosystem":"vendor"}],"ecosystems":[],"tags":["br-6208ac","edimax","home-router","infrastructure","iot"],"not_affected_if":["admin-interface-not-exposed","other-firmware"],"how_to_check":"- Log in to the router admin page and read the firmware version; the researcher tested BR-6208AC_1.32 (no other versions are named).\n- Check whether the admin web interface (HTTP, /goform/ paths) is reachable from the internet or from untrusted networks, including Wi-Fi guests. If so, treat the router as exposed.\n- Also check any other Edimax BR-6208AC units; the same firmware has several other published /goform/ injection flaws from the same researcher.","fix":null,"status":"open","published_at":"2026-11-05T00:17:24+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","triaged_at":"2026-11-05T00:31:38+00:00","updated_at":"2026-11-05T00:33:26+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-05T00:31:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Edimax BR-6208AC router: remote command injection via /goform/mp","impact":"high","summary":"Edimax BR-6208AC firmware 1.32 has a flaw in the /goform/mp web endpoint that allows command injection. A remote attacker who sends a crafted request can run commands on the router, and a public exploit has been published.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["edimax","br-6208ac","home-router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs commands on the router remotely","analyst_note":"Confirm whether the /goform/mp request needs authentication and whether any vendor firmware update exists; check the NVD page for the exploit reference.","how_to_check":"- Check the router firmware version in the admin interface; the sources name only version `1.32`.\n- Check whether the router's web admin interface is reachable from the internet or untrusted networks.\n- unknown for further checks: the sources do not say.","plain_action":"If you own an Edimax BR-6208AC router, check for a firmware update from Edimax, and keep its admin page off the internet until a fix is available.","needs_analyst":true,"not_affected_if":["other-firmware","admin-interface-not-exposed"],"who_is_affected":"Owners of Edimax BR-6208AC routers on firmware 1.32 with the web interface reachable, especially from the internet. The vendor did not respond to disclosure, so no patch is confirmed. Networks where the router's admin page is only reachable from trusted internal hosts face less exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000728,"input_tokens":4226,"output_tokens":610,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the /goform/mp request needs authentication and whether any vendor firmware update exists; check the NVD page for the exploit reference.","search":"'-122051':13A,16A '-2026':12A,15A '/goform/mp':10A,40B,90C '1.32':34B,78C '6208ac':4A,19A,22B,32B,77C 'affect':79C 'allow':44B 'attack':49B,100C 'br':3A,18A,21B,31B,76C 'br-6208ac':2A,17A,20B,30B,75C 'command':7A,45B,57B,97C 'contact':117C 'craft':53B 'cve':11A,14A 'disclosur':121C 'earli':118C 'edimax':1A,23B,29B,74C 'endpoint':42B 'execut':91C 'exploit':64B,106C 'file':89C 'firmwar':33B 'flaw':37B,69C 'found':72C 'function':86C 'home':25B 'home-rout':24B 'infrastructur':27B 'inject':8A,46B,98C 'iot':28B 'launch':103C 'lead':95C 'manipul':93C 'may':101C,111C 'public':63B 'publish':67B,109C 'remot':6A,48B,104C 'request':54B 'respond':125C 'router':5A,26B,60B 'run':56B 'send':51B 'unknown':85C 'use':113C 'vendor':115C 'via':9A 'vulner':82C 'way':128C 'web':41B","nicknames":[],"mitigations":[],"who_affected":"Owners of Edimax BR-6208AC routers running firmware 1.32. The researcher says the /goform/mp 'command' parameter reaches system() and needs no login, but this was shown in a firmware emulator (qemu), not on a real device. Routers whose admin page is reachable only from a trusted LAN face less exposure; the attacker still needs network access to the web interface.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own an Edimax BR-6208AC router, don't expose its admin page to the internet; Edimax has not published a fix, so consider replacing it with a supported router.","pkeys":["br6208ac"],"ptokens":["6208ac","br"],"labels":["br6208ac","critical","edimax","homerouter","infrastructure","iot"],"campaign_type":null,"first_public_at":"2026-11-05T00:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-122051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122051","severity":null,"published_at":"2026-11-05T00:17:24+00:00","modified_at":"2026-11-05T00:17:24+00:00","first_seen_at":"2026-11-05T00:31:01+00:00","fetched_at":"2026-11-05T00:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122051:1733","url":"https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md","severity":null,"published_at":"2026-11-05T00:33:26+00:00","modified_at":"2026-11-05T00:33:26+00:00","first_seen_at":"2026-11-05T00:33:26+00:00","fetched_at":"2026-11-05T00:33:26+00:00","note":"Primary source: researcher write-up (fizz-is-on-the-way/Iot_vuls RCE_mp) says pre-auth command injection via 'command' param in /goform/mp, shown in qemu emulation with PoC steps; NVD page is empty, CVE text says vendor never responded. No vendor advisory or firmware found at Edimax download page (page text empty), so fix unknown and nothing marked verified. Sibling VulDB CVEs for same model say product is no longer supported (not stated for this CVE). No exploitation in the wild reported.","cites":["https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md","https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection"]}],"documents":[{"id":71618,"url":"https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md","title":"EDIMAX BR-6208AC /goform/mp command injection (researcher write-up)","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":71619,"url":"https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection","title":"HOL Guard: CVE-2026-122051","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[{"type":"poc","url":"https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}