A remote, unauthenticated cross‑site scripting vulnerability exists in the Edimax BR‑6288ACL router firmware up to version 1.12. By supplying a crafted value in the manualssid parameter of the wiz_WISP24gmanual.asp page, an attacker can inject arbitrary JavaScript that executes in the browser of anyone who views the resulting page. This flaw, classified as CWE‑79 and discussed in relation to CWE‑94, can lead to session hijacking, redirection, or the exfiltration of credentials stored in the device’s web interface.

This issue affects Edimax BR‑6288ACL routers, firmware releases up to 1.12, which are no longer supported by the vendor. No other models or firmware versions are reported to be vulnerable.

The CVSS base score is 4.8, indicating moderate impact, while the low EPSS score of less than 1% suggests a very small exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by crafting a URL containing malicious JavaScript and delivering it to a user with access to the router’s web interface, which will render the script with the privileges of that user. No authentication or elevated privileges are required to trigger the vulnerability.