CVE-2026-122051 · Edimax BR-6208AC /goform/mp remote command injection

01 · The Real Story

An unpatched front door on an abandoned branch-office router left open to the street

CVE-2026-122051 is an unauthenticated command injection in the /goform/mp endpoint of Edimax BR-6208AC firmware 1.32. An attacker sends a crafted HTTP request to the router's web management interface and gains OS command execution, typically as root. The flaw affects remote management if the web admin is reachable, and a public proof-of-concept exists.

The vendor's CVSS 10 CRITICAL rating is technically accurate for a single exposed device, but it doesn't match enterprise patch-priority reality. The BR-6208AC is a consumer/SOHO router, likely out of support, rarely centrally managed, and usually not WAN-reachable by default. For a fleet of 10,000 hosts this is a niche branch-office or home-office risk, not a domain takeover or fleet-scale event.

"Remote pre-auth command injection on an old SOHO router, but the enterprise blast radius is tiny—downgrade from CVSS 10 to MEDIUM."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Find an exposed BR-6208AC

Attackers query Shodan, Censys, or FOFA for Edimax BR-6208AC web UI fingerprints, or scan internal subnets if they already have a foothold. The device is old and low-density, so candidate targets are scarce but easy to identify.

Conditions required:

Device web admin is reachable from attacker position (WAN or LAN)
Attacker knows target IP or subnet

Where this breaks in practice:

Most devices sit behind NAT with WAN-side management disabled
Product is old and has a small installed base

Detection/coverage: Shodan/Censys can identify exposed web UIs; internal scanning may appear in NAC or firewall logs.

STEP 02

Send crafted request to /goform/mp

The published proof-of-concept sends an HTTP POST or GET to /goform/mp with a parameter containing shell metacharacters. The vulnerable CGI passes attacker input to a system command without neutralization, allowing command injection.

Conditions required:

Web management interface accepts unauthenticated requests
Firmware is exactly 1.32

Where this breaks in practice:

Public PoC suggests no authentication barrier, but some deployments may restrict admin access to LAN only
Only the specific vulnerable firmware version is known affected

Detection/coverage: Network IDS/IPS may catch obvious command-injection payloads; a WAF in front of the router generally cannot inspect the router's own management plane.

STEP 03

Execute root commands and establish persistence

Shell access as root enables the attacker to modify startup scripts, add cron jobs, install backdoor binaries, or alter firewall rules. Persistence can survive reboot if writable flash is available.

Conditions required:

Successful command injection
Router has writable persistent storage

Where this breaks in practice:

Limited and sometimes fragile writable flash on consumer routers
A reboot may clear temporary files if persistence is only in tmpfs

Detection/coverage: No host EDR on the router; only network monitoring can detect unusual outbound connections from the device.

STEP 04

Pivot into connected networks and traffic

From the router, the attacker can redirect DNS, intercept unencrypted traffic, stage captive-portal phishing, or use the device as a pivot to reach LAN hosts and VPN clients. Modern TLS and DoH reduce but do not eliminate the value of this position.

Conditions required:

Router is default gateway or DNS for a useful network segment
Network has hosts worth pivoting to

Where this breaks in practice:

Home/SOHO segments typically have little value to an enterprise attacker
Modern clients using TLS and DNS-over-HTTPS reduce DNS-hijack yield

Detection/coverage: Unusual DNS queries, traceroute changes, or router config changes may be logged if the segment has managed network monitoring.

03 · Compensating Control

MEDIUM 5.5→LOW 3.0

SEVERITY REDUCED

Isolate and remove from internet exposure — Disable WAN-side remote management and restrict the web admin to a dedicated management VLAN. This breaks the unauthenticated remote attack path. Apply within hours for any known exposed device, even though the nominal MEDIUM verdict has no formal mitigation SLA.

MEDIUM 5.5→IGNORE 0.0

SEVERITY REDUCED

Replace unsupported BR-6208AC devices — Because the vendor is unresponsive, actual remediation is removal or replacement. Schedule replacement within the noisgate remediation SLA for MEDIUM: ≤ 365 days. Decommissioning the device eliminates the vulnerability entirely.

MEDIUM 5.5→LOW 2.0

SEVERITY REDUCED

Segment and monitor the router network — Place remaining devices in a restricted management VLAN with ACLs, and monitor for unusual DNS changes, unexpected outbound connections, or config modifications. Apply as a compensating control until replacement.

MEDIUM 5.5→MEDIUM 4.0

Inventory Edimax devices in the estate — Run asset discovery or network scans to identify all BR-6208AC units, including remote-worker and branch-office locations. Visibility is the precondition for isolation and replacement.

What doesn't work

Changing the admin password — if the endpoint is pre-auth command injection, authentication controls do not block exploitation.
Waiting for a vendor firmware patch — there is no confirmed fix and the vendor did not respond; treat the device as abandonware.
Placing a WAF in front of the router — the vulnerable component is the router's own management plane, and typical WAFs do not inspect or protect it.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No known campaigns; not in CISA KEV; VulDB CTI interest is low (1.34+).
Exploit availability	Public proof-of-concept referenced by VulDB and hosted on GitHub; exploit price roughly $0–$5k.
EPSS	EPSS not yet available from configured source; treat initial exploitation probability as low.
KEV status	Not listed in CISA Known Exploited Vulnerabilities.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — pre-auth remote, changed-scope full impact for a vulnerable router.
Affected versions	Edimax BR-6208AC firmware 1.32; VulDB references 1.34+ as a possible later version, but vendor confirmation is absent.
Fixed versions	No official vendor fix; vendor was contacted early and did not respond. Treat device as end-of-life.
Scanning/exposure data	No GreyNoise, Shodan, or Censys campaign data provided in search results; exposure likely limited to misconfigured WAN-admin devices.
Disclosure date	2026-11-05
Reporting source	VulDB CNA / unidentified original reporter; Rapid7 mirrors the CVE record.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to MEDIUM (5.5/10)

Why this verdict

Friction audit: exploitation requires reaching /goform/mp. On most BR-6208AC devices the web admin listens only on the LAN and is behind NAT with WAN-side management disabled. If only LAN-reachable, the attacker must already be inside the segment, which limits marginal risk.
Role multiplier: this is not a domain controller, IdP, PAM, hypervisor, SIEM, or canonical enterprise edge appliance. Compromise gives control of one small network segment, not domain, fleet, or supply-chain impact, so no severity floor above MEDIUM applies.
Published PoC and no patch: a working public exploit and an unresponsive vendor keep this from being LOW. Any exposed device becomes a persistent network pivot with no remediation path.

Why not higher?

Not HIGH: the affected device is a discontinued consumer/SOHO router with a tiny enterprise installed base. Most devices are not WAN-reachable unless remote management was explicitly enabled, and on internal networks the attacker must already have a foothold. The PoC has no observed in-the-wild use and is not KEV-listed, so this is not an active large-scale enterprise threat.

Why not lower?

Not LOW: the flaw is pre-auth command injection with a published exploit, and the vendor is unresponsive, so there is no official patch. Any exposed BR-6208AC becomes a persistent network pivot and DNS-hijack point, which is worse than a typical internal host bug.

06 · Verification

Crowdsourced verification payload.

Run from an admin workstation that can reach the Edimax web UI. Example: python3 cve_2026_122051_check.py 192.168.1.1. No special privileges are required. The script does not send exploit payloads; it fetches the landing page and reads the advertised firmware version.

noisgate-verify.py

PYTHONREAD-ONLYSAFE

#!/usr/bin/env python3
import sys, urllib.request, ssl, re

if len(sys.argv) != 2:
    print("Usage: python3 cve_2026_122051_check.py <router-ip>")
    sys.exit(2)

host = sys.argv[1]
url = f"http://{host}/"
ctx = ssl._create_unverified_context() if url.startswith("https") else None

try:
    req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
    with urllib.request.urlopen(req, timeout=10, context=ctx) as r:
        data = r.read(200000).decode("latin1", errors="ignore")
except Exception as e:
    print(f"UNKNOWN: could not fetch {url}: {e}")
    sys.exit(3)

m = re.search(r'BR-6208AC.*?[Ff]irmware[^\d]{0,20}(\d\.\d+)', data)
if not m:
    m = re.search(r'(\d\.\d+)', data)

if m and m.group(1) == "1.32":
    print("VULNERABLE: device reports firmware 1.32")
    sys.exit(0)
elif m:
    print(f"PATCHED: device reports firmware {m.group(1)}")
    sys.exit(0)
else:
    print("UNKNOWN: cannot determine firmware version from web UI")
    sys.exit(3)