A command injection flaw exists in the /goform/formAccept web interface of the Edimax BR-6208AC router, caused by insufficient input validation of the submit-url parameter (CWE-74) and leading to command injection (CWE-77). Manipulating the submit-url argument allows an attacker to execute arbitrary shell commands on the device via a standard HTTP request. This can lead to full device compromise, enabling the attacker to exfiltrate data, install malware, or pivot to other systems on the local network (inferred).

The flaw affects the Edimax BR-6208AC router running firmware 1.32. The device is no longer supported by the manufacturer, and there is no official patch. Only this version and other unmaintained units are impacted.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of 2% indicates a low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is remote via HTTP, and the exploit has been published publicly, meaning an attacker can readily construct a payload. Consequently, the risk of exploitation is non‑negligible and the potential impact could be significant if the device is exposed to the internet.