The flaw involves the auth_check_userpass2 function, which accepts a hard‑coded credential set. By sending a crafted username/password pair the device authenticates using the default credentials, allowing an attacker to gain privileged access. The weakness is classed as CWE‑1392. An attacker who succeeds can observe or modify device configuration, potentially enabling further compromise.

Edimax BR‑6208AC routers running firmware 2_1.02 are affected. The vendor has declared the product end‑of‑life and will not release a patch. Devices may also be found running earlier 2.0 firmware versions, but only the 2_1.02 release has confirmed vulnerability.

The CVSS baseline is 6.9, indicating a moderate severity, while EPSS below 1% shows a very low probability of exploitation but still feasible due to the public exploit. The vulnerability has not been listed in the CISA KEV catalog. Remote attackers with network access to the device can exploit the weakness without authentication, so the attack surface is wide. Because a vendor fix is unavailable, the risk remains elevated for any remaining units in production.