A flaw in the /goform/formFilter endpoint of Edimax BR-6208AC firmware 1.32 allows an attacker to inject arbitrary JavaScript code. The vulnerability is triggered by manipulating an unknown function within that endpoint, leading to reflected cross‑site scripting. Attackers can exploit this remotely and an exploit script is publicly available, meaning the attack could be automated programmatically. The primary consequence is the execution of malicious scripts inside users' browsers, potentially enabling session hijacking, defacement, or credential theft.

The issue affects the Edimax BR‑6208AC wireless router running firmware version 1.32. No other firmware versions or related products are listed as affected. The vulnerability is tied directly to the router’s web management interface accessed via the /goform/formFilter path.

The CVSS base score of 4.8 indicates a moderate severity. No EPSS data is available, and the vulnerability is not cataloged in the CISA KEV list, so current exploitation likelihood is indeterminate. Nevertheless, because the flaw can be triggered from any remote location with network connectivity to the router’s web interface, the attack surface remains significant. If a publicly available exploit is used, an attacker can silently inject malicious code into the managed device’s web pages, which may lead to compromised credentials or further lateral movement within the local network.