The flaw resides in the Virtual Server page of the Edimax BR-6208AC router and allows attackers to inject malicious script code. This cross-site scripting vulnerability gives an adversary the ability to execute arbitrary client-side code in the context of the web interface, potentially facilitating credential theft, defacement, or further internal compromise. The weakness is identified by CWE-79 and CWE-94, indicating script injection and code execution risks.

Vulnerable devices are Edimax BR-6208AC routers running firmware version 1.32. No other models or firmware revisions are listed as affected, and the vendor has not documented wider impact.

Attackers could trigger the XSS remotely by sending crafted requests to the Virtual Server page. The description does not explicitly state whether authentication of the web interface is required; it only indicates that remote exploitation is possible. Therefore, the exact access requirements remain uncertain. The vulnerability is publicly disclosed and could be leveraged against any exposed device. The CVSS score is 4.8, indicating moderate severity. It is not currently listed in the CISA KEV catalog, and no EPSS score is available, leaving exploitation likelihood uncertain.