CVE-2026-108914

Executive Summary

CVE-2026-108914 is a remote buffer overflow (CWE-119) in the Edimax BR-6208AC wireless router, firmware version 1.32, reachable through the web management interface at the endpoint /goform/formWlSiteSurvey. An authenticated network-adjacent or remote attacker who can reach the router's administrative interface can manipulate the ifname argument to corrupt memory and potentially achieve code execution. The vulnerability carries a CVSS 3.1 base score of 9.9 (Critical), the exploit has been publicly published, and the vendor has neither patched the device nor responded to the disclosure — the product is end-of-life and will remain permanently vulnerable.

Technical Analysis

The flaw resides in the formWlSiteSurvey handler served under the /goform/ CGI-style path of the Edimax BR-6208AC management interface. The NVD description states that manipulation of the ifname argument causes a buffer overflow — a classic CWE-119 improper restriction of operations within the bounds of a memory buffer. The ifname parameter is evidently copied or formatted into a fixed-size destination buffer in native code without adequate bounds checking, allowing attacker-controlled data to overwrite adjacent memory on the stack or heap.

Because this is CWE-119 rather than a specific memory-safety subclass, the exact primitive (stack overflow, heap overflow, or off-by-N) cannot be confirmed from the available disclosure. What is confirmed is that the endpoint is network-reachable, that the ifname input is the sole manipulation vector named, and that the overflow is exploitable enough to warrant a 9.9 score. The scope change (S:C) and full CIA impact indicate that successful exploitation crosses a security boundary — from the management web process into the underlying system, which is the normative behavior of native-code buffer overflows in router firmware running privileged daemons.

Attack surface: the router's HTTP management service on the LAN (and potentially WAN if remote management is enabled). No authentication mechanism is specified as bypassed; the CVSS privileges-required metric of Low (PR:L) implies the attacker typically needs at least a low-privileged session or equivalent access to the form handler. The AC:L/AV:N combination means no special conditions or physical proximity are required beyond network reachability.

Exploitation Scenarios

No public exploit code, Nuclei template, or repository is referenced in the provided data. However, NVD states the exploit has been published and may be used, so an attack chain is plausible at the vulnerability-class level.

1. Reconnaissance / target identification — The attacker scans for Edimax BR-6208AC devices using Shodan dorks such as product:"Edimax BR-6208AC" or http.html:"formWlSiteSurvey", or enumerates management ports on the local network (port 80/443, typical embedded web server ports). The /goform/ naming convention and formWlSiteSurvey endpoint are characteristic fingerprints.

2. Triggering the flaw — The attacker sends an HTTP request to /goform/formWlSiteSurvey including the ifname parameter set to an oversized or malformed value. The handler processes this input and copies it into a fixed-size buffer without validating length, causing memory corruption. Because the disclosure does not specify the exact character set, encoding, or overflow length required, the precise payload is defined by the published exploit — which is not reproduced here.

3. Payload / execution — At the vulnerability-class level, the attacker aims to overwrite return addresses, function pointers, or heap metadata to redirect control flow. The high AC:L rating suggests the overflow is reliably reproducible; the Scope:Changed metric implies the compromise may propagate beyond the web handler process.

4. Post-exploitation — Full CIA impact (C:H/I:H/A:H) means an attacker who achieves code execution typically gains privileged access to the device's embedded OS: complete configuration disclosure (Wi-Fi PSKs, admin credentials, WAN settings), modification of routing/DNS, persistence via firmware or config modification, and use as a pivot into the internal network. Given the device is EOL, there is no vendor remediation path.

Impact Assessment

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields a base score of 9.9. Key implications:

• Confidentiality (High): full read access to device configuration, credentials, and network traffic passing through the router.
• Integrity (High): arbitrary modification of device behavior, routing tables, and potentially injected content.
• Availability (High): crash or full takeover leading to denial of service for all connected clients.
• Scope (Changed): exploitation escapes the web handling component's authority, consistent with native code execution.
• PR:L / UI:N: an attacker with low privileges and no user interaction can trigger the condition, widening the pool of viable attackers. No EPSS score is currently published by FIRST.org, so probabilistic exploitation likelihood is not yet quantified, but the public exploit increases real-world risk.

Blast radius: every network segment behind an actively used BR-6208AC is in scope, including home offices, small business networks, and any environment still running this discontinued device. Because it is EOL, host-based patching does not exist — the only true remediation is hardware replacement.

Detection Guidance

Sigma Rule

title: Edimax BR-6208AC formWlSiteSurvey Buffer Overflow Attempt
id: 8a4f2c1e-1089-4d7b-9c3e-edimax6208ac001
status: experimental
description: Detects HTTP requests to the Edimax BR-6208AC /goform/formWlSiteSurvey endpoint with an abnormally long ifname parameter indicative of CVE-2026-108914.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108914
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: edimax
detection:
  selection_uri:
    cs-uri-stem|endswith: '/goform/formWlSiteSurvey'
  selection_len:
    cs-uri-query|re: '(?i)ifname=.{256,}'
  condition: selection_uri and selection_len
fields:
  - c-ip
  - cs-uri-query
falsepositives:
  - Legitimate administrative configuration with unusually long interface names (unlikely)
level: high
tags:
  - attack.t1190
  - cve.2026.108914

YARA Rule

rule CVE_2026_108914_Edimax_formWlSiteSurvey
{
    meta:
        description = "Detects HTTP request patterns targeting the Edimax BR-6208AC /goform/formWlSiteSurvey buffer overflow (CVE-2026-108914)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108914"
        date = "2026-01-01"
        cve = "CVE-2026-108914"
    strings:
        $uri = "/goform/formWlSiteSurvey"
        $param = "ifname="
        $pad = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
    condition:
        $uri and $param and $pad
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108914 Edimax BR-6208AC formWlSiteSurvey ifname buffer overflow attempt"; flow:to_server,established; http.uri; content:"/goform/formWlSiteSurvey"; http.uri; content:"ifname="; http.uri; pcre:"/ifname=[^\s&]{256,}/i"; reference:cve,2026-108914; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108914; classtype:attempted-admin; sid:2026108914; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" or http.request.method == "POST"
  and stringContains(url.path, "/goform/formWlSiteSurvey")
  and stringContains(http.request.body, "ifname=")
  and length(http.request.body) > 300

Splunk SPL Query

index=web OR index=proxy
| search uri="*goform/formWlSiteSurvey*"
| rex field=uri "ifname=(?<ifname_val>[^&\s]+)"
| eval ifname_len=len(ifname_val)
| where ifname_len > 256 OR isnull(ifname_val)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, ifname_len
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-108914">
  <rule id="108914" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/goform/formWlSiteSurvey</url>
    <regex type="pcre2">ifname=[^\s&amp;]{256,}</regex>
    <description>CVE-2026-108914: Edimax BR-6208AC formWlSiteSurvey ifname buffer overflow attempt detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted and did not respond; the product is explicitly out of support. There is no fixed firmware to upgrade to.

1. Immediate mitigations

• Replace affected BR-6208AC devices; do not rely on continued operation of an EOL, unpatched router on any trusted network.
• If replacement is impossible in the short term, isolate the device on a dedicated VLAN with strict egress/ingress filtering, and disable remote/WAN management and any unused management interfaces.
• Restrict management access to a single hardened administrative host or management subnet; enforce strong, unique admin credentials.
• Monitor for the detection signatures above; treat any oversized ifname request to /goform/formWlSiteSurvey as an active exploitation attempt.

2. Patch/upgrade steps

• No official patch exists and none is expected. Confirm current firmware is 1.32 (the affected version) and plan for hardware replacement rather than firmware upgrade.
• Where replacement is scheduled, document the device in an asset inventory with an end-of-life risk flag.

3. Long-term hardening

• Establish a lifecycle policy forbidding EOL network gear on production networks.
• Segment IoT/SOHO routing equipment from sensitive segments by default.
• Add egress filtering and DNS monitoring for compromised edge devices.
• Feed CVE-2026-108914 signatures into network monitoring until all units are decommissioned.

References

• NVD — CVE-2026-108914: https://nvd.nist.gov/vuln/detail/CVE-2026-108914
• MITRE CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): https://cwe.mitre.org/data/definitions/119.html
• FIRST.org EPSS (no score published as of report date): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (not listed at report time): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Edimax product/support pages for EOL confirmation: https://www.edimax.com/

Threat actor context: No specific campaign, APT group, or in-the-wild exploitation telemetry is provided in the available data. The NVD description states a public exploit "has been published and may be used," which raises the likelihood of opportunistic scanning and exploitation by commodity botnets targeting exposed routers. No KEV listing is present.