The vulnerability is a cross‑site scripting flaw located in the /goform/formUrlb page of the HTTP Blocking component of the Edimax BR‑6208AC firmware 1.32. An attacker can send a crafted request to this endpoint, causing malicious script code to be returned to the browser. The injected code runs in the victim’s browser context, enabling the attacker to steal session tokens, capture credentials, or modify page content. This weakness is mapped to CWE‑79 and CWE‑94.

The flaw affects all Edimax BR‑6208AC units that run firmware version 1.32 and expose the HTTP Blocking formUrlb API. The device’s web interface is reachable via standard HTTP/HTTPS protocols, and the vulnerable endpoint is publicly accessible from the network. No other firmware revisions are known to contain the same endpoint or to be vulnerable.

The CVSS base score of 4.8 places the vulnerability in the medium severity range. Attackers can trigger the flaw remotely without authentication, and exploit samples have been released publicly. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Because the endpoint is exposed over the web and the flaw allows arbitrary script execution, the overall risk remains significant for environments where the device is reachable from untrusted networks.