The vulnerability is in the setWAN function of the L2TP Mode handling in Edimax BR-6208AC firmware 1.02. An attacker can send a specially crafted L2TPUserName parameter to the /goform/setWAN endpoint, causing the firmware to shell out the unfiltered string and execute arbitrary commands. This results in complete remote command execution on the device, giving the attacker full control of the router’s operating system. The weakness is a classic command injection flaw (CWE‑74) combined with improper input validation (CWE‑77). The impact involves confidentiality, integrity, and availability of all devices behind the router as the attacker can tamper with traffic or bypass network controls.

The affected product is the Edimax BR‑6208AC router. Firmware version 1.02 includes the vulnerable L2TP setWAN command. No other vendor or version strings were listed. The entry lists Edimax:BR‑6208AC as the impacted vendor/product. Users running firmware 1.02 should verify whether their devices are on that version.

Although the CVSS score is 5.3, the exploit is already publicly available and was published by the community. No EPSS score is listed, implying the estimate is unavailable but considering the exploit was released, the probability of exploitation is non‑trivial. The attack vector would be remote, via the L2TP interface exposed on the router’s management web server. The impact is high in terms of potential damage. The vulnerability is not currently catalogued in the CISA KEV list, but due to its remote execution nature, it should be treated as a significant risk.