A flaw exists in the Edimax BR-6208AC 1.32 firmware, specifically within the /goform/formQoS endpoint of the QoS Page. By manipulating inputs sent to this form, an attacker can inject arbitrary script code that will be executed in the browser of anyone who views the QoS configuration page. This is a classic reflected cross‑site scripting vulnerability (CWE‑79) and also exposes a potential for code injection via input fields (CWE‑94). The documented CVSS score of 4.8 indicates a moderate severity for a web‑based vulnerability.

The vulnerable component is found in the Edimax BR‑6208AC wireless router, firmware version 1.32. The affected product listing from the CNA is Edimax:BR‑6208AC, and the CPE string confirms the same hardware and firmware family. No other products or versions are explicitly mentioned, so only this model and firmware is currently known to be vulnerable.

The vulnerability can be exploited remotely without authentication, as the attacker only needs to craft a URL or form submission that reaches the exposed endpoint. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not a widely monitored exploitation target at this time; however, public disclosure has been made and the exploit code is available online. The moderate CVSS score reflects the potential impact on confidentiality and integrity of configuration data but does not imply a full system compromise.