A command injection flaw exists in the /goform/mp endpoint of the Edimax BR-6208AC router firmware 1.32. An attacker can craft a request that causes the device to execute arbitrary shell commands with the privileges of the router process. This results in remote code execution, allowing full control of the device, including data exfiltration, firmware tampering, or turning the router into a malicious node.

The flaw affects only the Edimax BR-6208AC model running firmware version 1.32. No other Edimax router models or firmware releases were identified as vulnerable. The port and web interface used for the /goform/mp functionality are exposed to the internet, making every deployed unit potentially reachable.

The CVSS score of 10 indicates a critical severity. The EPSS score is not provided, but the flaw has an available exploit and is listed in public repositories, indicating active use. Because the attack can be executed remotely over HTTP/HTTPS, an attacker does not need local access. The vulnerability is not yet catalogued in the CISA KEV list.