CVE-2026-116227

Edimax BR-6208AC Virtual Server cross site scripting

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw resides in the Virtual Server page of the Edimax BR-6208AC router and allows attackers to inject malicious script code. This cross-site scripting vulnerability gives an adversary the ability to execute arbitrary client-side code in the context of the web interface, potentially facilitating credential theft, defacement, or further internal compromise. The weakness is identified by CWE-79 and CWE-94, indicating script injection and code execution risks.

Affected Systems

Vulnerable devices are Edimax BR-6208AC routers running firmware version 1.32. No other models or firmware revisions are listed as affected, and the vendor has not documented wider impact.

Risk and Exploitability

Attackers could trigger the XSS remotely by sending crafted requests to the Virtual Server page. The description does not explicitly state whether authentication of the web interface is required; it only indicates that remote exploitation is possible. Therefore, the exact access requirements remain uncertain. The vulnerability is publicly disclosed and could be leveraged against any exposed device. The CVSS score is 4.8, indicating moderate severity. It is not currently listed in the CISA KEV catalog, and no EPSS score is available, leaving exploitation likelihood uncertain.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router to the latest firmware that removes the vulnerable Virtual Server component
  • If no update exists, disable the Virtual Server feature in the device settings or block its port using a firewall
  • Restrict administrative access to the device to trusted networks and use network segmentation to limit exposure

Generated by OpenCVE AI on October 26, 2026 at 09:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Edimax br-6208ac
Vendors & Products Edimax br-6208ac
Type Values Removed Values Added
Description A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Edimax BR-6208AC Virtual Server cross site scripting
First Time appeared Edimax
Edimax br-6208ac Firmware
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
Vendors & Products Edimax
Edimax br-6208ac Firmware
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 31, 2026, 1:05 AM
Reserved
Oct 25, 2026, 2:32 PM

View source JSON

Updated
Oct 31, 2026, 1:05 AM

JSON

Status
Deferred
Published
Oct 26, 2026, 7:17 AM
Modified
Oct 31, 2026, 1:17 AM

View source JSON

No data.

Updated
Oct 26, 2026, 9:45 AM

JSON