CVE-2026-108917

Executive Summary

CVE-2026-108917 is a critical (CVSS 10.0) command injection vulnerability in the Edimax BR-6208AC wireless router, firmware version 1.32. The flaw resides in the handling of the tftpsIP argument submitted to the /goform/formAutoFWupgrade endpoint, allowing an unauthenticated remote attacker to execute arbitrary operating system commands on the device. Because the product has reached end-of-support and the vendor did not respond to disclosure, no patch or workaround exists, and exploitation is trivial for anyone with network reachability to the device management interface.

Technical Analysis

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, colloquially "Injection"). In this instance, the specific downstream impact is command injection (CWE-78 class behavior realized through the CWE-74 weakness family). The NVD description states that "some unknown processing of the file /goform/formAutoFWupgrade" is affected and that "executing a manipulation of the argument tftpsIP can lead to command injection."

The attack surface is the router's embedded web management interface, which exposes the formAutoFWupgrade handler. This handler is intended to let an administrator configure an automatic firmware upgrade by supplying a TFTP server address (tftpsIP). The observed weakness class indicates that the supplied tftpsIP value is passed into a shell context (for example, a TFTP client invocation) without adequate sanitization of shell metacharacters, enabling an attacker to append or embed arbitrary commands that are executed with the privileges of the web server process (typically root on embedded router firmware).

Key technical facts derivable from the provided data:

• Attack vector is remote and network-reachable (AV:N).
• No authentication, privileges, or user interaction is required (PR:N, UI:N).
• The vulnerable parameter is tftpsIP on the /goform/formAutoFWupgrade endpoint.
• The impact scope is changed (S:C), meaning exploitation of the router can affect resources beyond the vulnerable component itself (e.g., pivot into the adjacent network).
• Confidentiality, integrity, and availability impacts are all rated High (C:H/I:H/A:H).

No public proof-of-concept code, Nuclei template, or exploit code is known to this dataset. The absence of a PoC does not reduce risk: command injection into an unauthenticated HTTP handler is a well-understood, low-complexity attack class. The description explicitly states the exploit "has been publicly disclosed and may be utilized," which raises the likelihood of opportunistic scanning and exploitation. No code-level details beyond the parameter and endpoint are available; any further specifics (e.g., exact shell invocation, filter behavior) cannot be stated without fabrication. The affected firmware is version 1.32, and the vendor has confirmed (by non-response plus end-of-support status) that no fix will be provided.

Exploitation Scenarios

The following attack chain is inferred at the vulnerability-class level from the NVD description. No specific payload strings are provided because no public PoC is available.

1. Reconnaissance / Target Identification. An attacker scans the internet (or an internal network segment) for exposed Edimax BR-6208AC management interfaces, typically on TCP/80 or TCP/443. Fingerprinting relies on the router's administrative login page and the presence of the /goform/ handler family. Shodan-style dorks such as product:"Edimax BR-6208AC" or http.html:"formAutoFWupgrade" can locate candidate hosts.

2. Triggering the Flaw. The attacker sends an HTTP request to the /goform/formAutoFWupgrade endpoint. Because the vulnerability requires no authentication (PR:N), the request is crafted to supply a malicious value in the tftpsIP argument. The flaw class (CWE-74, realized as command injection) means the supplied value is incorporated into a shell-invoked command without proper neutralization of special elements. This is achievable pre-authentication if the handler is reachable without a valid session.

3. Payload / Execution. At the vulnerability-class level, the attacker embeds shell metacharacters and operating-system commands within the tftpsIP value so that, when the handler constructs and executes its TFTP-related command, the injected commands are executed on the device. The exact concatenation and executable context cannot be confirmed from the available data and are therefore not specified here. Successful injection yields command execution under the web service's privilege level (commonly root on consumer routers).

4. Post-Exploitation Impact. With command execution, an attacker can read and exfiltrate device configuration and credentials, alter firewall/DNS/routing settings, establish persistence, recruit the device into a botnet, pivot into the internal network (reflected by the S:C scope change), or render the device inoperable. The High ratings across confidentiality, integrity, and availability underscore the severe and broad blast radius.

Impact Assessment

CVE-2026-108917 carries a CVSS v3.1 base score of 10.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Subscore interpretation:

• Attack Vector (Network): exploitable remotely across a network boundary.
• Attack Complexity (Low): no special conditions or race windows required.
• Privileges Required (None) / User Interaction (None): no credentials or victim action needed.
• Scope (Changed): exploitation can compromise resources beyond the router itself, enabling lateral movement.
• C/I/A (High/High/High): full loss of confidentiality, integrity, and availability.

Affected systems are Edimax BR-6208AC routers running firmware 1.32. These are consumer/SOHO devices frequently deployed as network edge appliances in homes and small offices, meaning a compromised unit sits directly at a trust boundary. Blast radius includes all devices and credentials traversing that router, plus any internal hosts reachable after pivoting. Business impact for an organization using such a device at a branch or remote-worker location includes network breach, data exfiltration, and loss of network availability. Because the product is end-of-support, remediation options are constrained to replacement or compensating controls.

Detection Guidance

Sigma Rule

title: Edimax BR-6208AC formAutoFWupgrade Command Injection Attempt
id: 6f2b9e4a-1089-4c1e-9d17-2026108917aa
status: experimental
description: Detects HTTP requests targeting the Edimax BR-6208AC formAutoFWupgrade endpoint with suspicious shell metacharacters in the tftpsIP parameter (CVE-2026-108917).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108917
author: valtersit.com
logsource:
  category: webserver
  product: edimax
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/goform/formAutoFWupgrade'
  selection_param:
    cs-uri-query|contains:
      - 'tftpsIP='
  selection_metachar:
    cs-uri-query|re: '(;|\||`|\$\(|&|>|<|%3b|%7c|%60|%24%28)'
  condition: selection_endpoint and selection_param and selection_metachar
falsepositives:
  - Legitimate TFTP server configuration (rare; validate value against allowlist)
level: critical
tags:
  - attack.t1190
  - cve.2026-108917

YARA Rule

rule CVE_2026_108917_Edimax_TFTPSIP_Injection
{
    meta:
        description = "Detects exploitation attempts against Edimax BR-6208AC formAutoFWupgrade (CVE-2026-108917) in HTTP traffic or logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108917"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $endpoint = "/goform/formAutoFWupgrade" ascii nocase
        $param    = "tftpsIP=" ascii nocase
        $meta1    = ";" ascii
        $meta2    = "|" ascii
        $meta3    = "`" ascii
        $meta4    = "$(" ascii
        $meta5    = "&&" ascii

    condition:
        $endpoint and $param and any of ($meta*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108917 Edimax BR-6208AC formAutoFWupgrade tftpsIP Command Injection Attempt"; flow:established,to_server; http.uri; content:"/goform/formAutoFWupgrade"; http.uri; content:"tftpsIP="; pcre:"/(tftpsIP=[^&]*(;|%3b|\||%7c|`|%60|\$\(|%24%28|&&))/i"; classtype:web-application-attack; reference:cve,2026-108917; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108917; sid:2026108917; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "GET" or http.request.method == "POST"
      and url.path == "/goform/formAutoFWupgrade"
      and url.query : "tftpsIP=*" ]
  [ network where url.query : "tftpsIP=*"
      and url.query regex~ ".*(;|\\||`|\\$\\(|&&).*" ]

Splunk SPL Query

index=web OR index=proxy
| search uri_path="/goform/formAutoFWupgrade" OR uri="*/goform/formAutoFWupgrade*"
| rex field=uri_query "tftpsIP=(?<tftps_value>[^&]+)"
| where match(tftps_value, "(;|%3b|\||%7c|`|%60|\$\(|%24%28|&&|>|<)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, http_method, tftps_value
| sort - count

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-108917,">
  <rule id="2026108" level="12">
    <if_sid>31100</if_sid>
    <id>^/goform/formAutoFWupgrade</id>
    <description>CVE-2026-108917: Edimax BR-6208AC formAutoFWupgrade access attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026109" level="15">
    <if_sid>2026108</if_sid>
    <regex>tftpsIP=[^&]*(;|\||`|\$\(|&&|%3b|%7c|%60|%24%28)</regex>
    <description>CVE-2026-108917: CRITICAL - Edimax BR-6208AC tftpsIP command injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, the vendor (Edimax) was contacted about this disclosure but did not respond, and the product is no longer supported.

1. Immediate mitigations.

   • Remove or isolate Edimax BR-6208AC devices from any internet-facing or untrusted network exposure. Do not rely on the device's own firewall or NAT to protect management interfaces.
   • Block external access to the management web interface (TCP/80, TCP/443) at the perimeter and restrict administrative access to a dedicated, trusted management VLAN.
   • Where the device must remain in use, place it behind a managing firewall/router that blocks inbound access to /goform/ endpoints from untrusted sources.
   • Monitor for and block requests to /goform/formAutoFWupgrade that carry suspicious shell metacharacters in tftpsIP, using the detection rules above.

2. Patch / upgrade steps.

   • No firmware patch is available for firmware 1.32 and none is expected, as the product is end-of-support. The only definitive remediation is hardware replacement with a currently supported, actively maintained router/firewall.
   • After replacement, ensure the new device runs the latest vendor firmware and has automatic updates enabled where available.

3. Long-term hardening.

   • Maintain a hardware lifecycle inventory and replace end-of-support network equipment before it becomes unmaintained.
   • Enforce a policy of no direct internet exposure of router/device management interfaces; require VPN or jump-host access for administration.
   • Apply network segmentation so that a compromised edge device cannot freely reach internal hosts (mitigating the CVSS S:C scope change).
   • Continuously monitor exposed device fingerprints (e.g., via Shodan/Censys) to detect unexpected internet-facing management interfaces.
   • Rotate any credentials or pre-shared keys that may have transited a potentially compromised device.

References

• NVD — CVE-2026-108917: https://nvd.nist.gov/vuln/detail/CVE-2026-108917
• MITRE CWE-74 (Improper Neutralization of Special Elements in Output): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Edimax product/support page (vendor did not respond to disclosure; BR-6208AC end-of-support): https://www.edimax.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-108917 not currently listed; monitor for updates): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or confirmed in-the-wild campaign is associated with CVE-2026-108917 in the available data; however, the disclosure states the exploit has been made public and may be utilized, warranting proactive monitoring.