---
id: "CVE-2026-122051"
kind: "vulnerability"
aliases: ["CVE-2026-122051"]
title: "Edimax BR-6208AC router: remote command injection via /goform/mp"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "BR-6208AC", "fixed": [], "affected": "firmware 1.32", "ecosystem": "vendor"}]
ecosystems: []
tags: ["br-6208ac", "edimax", "home-router", "infrastructure", "iot"]
not_affected_if: ["admin-interface-not-exposed", "other-firmware"]
published_at: "2026-11-05T00:17:24+00:00"
first_seen_at: "2026-11-05T00:31:01+00:00"
updated_at: "2026-11-05T00:33:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122051", "first_seen_at": "2026-11-05T00:31:01+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection", "first_seen_at": "2026-11-05T00:33:26+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection", "https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md"]}]
exploit_sources: [{"type": "poc", "url": "https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md"}]
---

# Edimax BR-6208AC router: remote command injection via /goform/mp

Edimax BR-6208AC firmware 1.32 has a flaw in the /goform/mp web endpoint that allows command injection. A remote attacker who sends a crafted request can run commands on the router, and a public exploit has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BR-6208AC affected firmware 1.32 fixed no fixed version listed

## How to check

- Log in to the router admin page and read the firmware version; the researcher tested BR-6208AC_1.32 (no other versions are named).
- Check whether the admin web interface (HTTP, /goform/ paths) is reachable from the internet or from untrusted networks, including Wi-Fi guests. If so, treat the router as exposed.
- Also check any other Edimax BR-6208AC units; the same firmware has several other published /goform/ injection flaws from the same researcher.

## Timeline

- 2026-11-05T00:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122051
- 2026-11-05T00:33:26+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection — Primary source: researcher write-up (fizz-is-on-the-way/Iot_vuls RCE_mp) says pre-auth command injection via 'command' param in /goform/mp, shown in qemu emulation with PoC steps; NVD page is empty, CVE text says vendor never responded. No vendor advisory or firmware found at Edimax download page (page text empty), so fix unknown and nothing marked verified. Sibling VulDB CVEs for same model say product is no longer supported (not stated for this CVE). No exploitation in the wild reported.

## Documents

- [mentions] HOL Guard: CVE-2026-122051 https://hol.org/guard/security/cves/CVE-2026-122051-edimax-br-6208ac-mp-command-injection
- [poc] EDIMAX BR-6208AC /goform/mp command injection (researcher write-up) https://raw.githubusercontent.com/fizz-is-on-the-way/Iot_vuls/main/BR-6208AC/RCE_mp/README.md

## From the sources

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_