A command injection flaw exists in the Edimax BR-6208AC firmware 1.32, triggered by manipulating the tftpsIP parameter in the /goform/formAutoFWupgrade HTTP endpoint. This flaw allows a remote attacker to inject operating system commands that are executed with the privileges of the device, effectively giving full control of the unit. The underlying weakness is a classic invalid input handling (CWE-74) combined with a permission escalation (CWE-77).

The vulnerability affects the Edimax BR-6208AC series running firmware 1.32. The only affected devices are those for which the maintainer no longer supplies support or updates.

The CVSS score of 10 indicates a critical severity. The EPSS score of 2% indicates a low but non-zero likelihood of exploitation, although a publicly available exploit already suggests that the risk is non-negligible. The exploitation can be performed from a remote network without local access, making the attack vector high. The absence of inclusion in the CISA KEV catalog does not reduce the risk, as the flaw is already publicly disclosed and usable.