CVE-2026-108933

Executive Summary

CVE-2026-108933 is a stored/reflected cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC wireless router, firmware version 1.32, located in the /goform/formFilter handling path. The flaw is remotely triggerable, though the CVSS vector (PR:H, UI:R) indicates it is only exploitable by an authenticated administrative user against a victim who must interact with a crafted request. Impact is limited to integrity (I:L) with no confidentiality or availability effect, yielding a base score of 2.4.

Technical Analysis

The vulnerability resides in the Edimax BR-6208AC firmware version 1.32 within the /goform/formFilter endpoint. The NVD description confirms that an "unknown function of the file /goform/formFilter" is affected and that "such manipulation leads to cross site scripting." No specific parameter name, function name, or code path is disclosed in the available intelligence.

Cross-site scripting (CWE-79) is a class of injection defect in which attacker-controlled input is rendered into an HTTP response without adequate output encoding or contextual escaping. When the input is not neutralized, the browser parses it as executable script within the trust context of the vulnerable origin (the router's management interface). Within embedded router firmware, /goform/* endpoints are typically CGI-style handlers that accept form POST data and reflect or persist values into subsequent HTML pages rendered in the admin UI.

The CVSS vector establishes several important constraints on the attack surface:

• AV:N (Network) — the endpoint is reachable over the network; on this device class, the admin interface is normally exposed on the LAN and, depending on deployment, potentially on the WAN if remote management is enabled.
• PR:H (High privileges required) — the attacker must already hold administrative credentials to submit the malicious input, or must induce an authenticated admin to do so.
• UI:R (User interaction required) — the victim must load or interact with a page that renders the injected content; the script does not auto-execute purely from the network request.
• S:U (Scope unchanged) and C:N/I:L/A:N — exploitation is confined to the router's origin and affects only integrity, with no direct confidentiality or availability loss per the score.

Because no function name, parameter, or concrete sink is published, the exact injection point (reflected vs. stored) cannot be definitively stated from the available data. The presence of the file /goform/formFilter in the description indicates the filter-rule management form is the injection surface. No public PoC, Nuclei template, or exploit code is tracked, and the vendor did not respond to the reporter.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the XSS vulnerability class and the CVSS constraints supplied.

1. Reconnaissance / target identification. The attacker identifies an Edimax BR-6208AC running firmware 1.32 with a reachable management interface. Device fingerprinting can be performed via the web admin login page and HTTP response headers. Shodan queries such as product:"Edimax BR-6208AC" or http.html:"/goform/formFilter" can locate candidate hosts, subject to Shodan coverage.

2. Triggering the flaw class. The attacker—now authenticated with admin privileges (PR:H)—submits a crafted value through the /goform/formFilter form. Because the affected function and parameter are not disclosed, the precise input field cannot be named. At the vulnerability-class level, the input is stored or reflected without adequate HTML/JavaScript encoding, so script content survives into a rendered admin page.

3. Payload / execution. When an authenticated administrator (UI:R) navigates to the page that renders the tainted value, the injected script executes in the context of the router's management origin. A typical objective at this stage is session or credential theft from the admin UI, or issuing authenticated state-changing requests (e.g., altering router configuration) on the victim's behalf.

4. Post-exploitation impact. Consistent with C:N/I:L/A:N, the demonstrated impact is integrity-only against the management UI. The scripting context could enable configuration tampering performed through the authenticated admin session, though the score assigns no confidentiality or availability impact and the scope remains unchanged.

Impact Assessment

The direct impact is constrained by the CVSS subscores: C:N (no confidentiality), I:L (low integrity), A:N (no availability), S:U (scope unchanged). Business risk is therefore concentrated in management-plane integrity for organizations that deploy the BR-6208AC. Blast radius is limited to the individual device and its administrative session rather than lateral movement, since scope is unchanged and no confidentiality impact is scored.

Practical exposure factors that raise real-world concern beyond the 2.4 base score:

• The device is an edge SOHO/SMB router; compromise of its admin plane can be a precursor to downstream network changes, even though the scored impact is low.
• The vendor did not respond to coordinated disclosure, so the defect persists in deployed firmware 1.32, increasing the window in which an internal or WAN-exposed admin session could be abused.
• The NVD notes the exploit is publicly available and "might be used," which increases the likelihood of opportunistic targeting of exposed management interfaces.

The 2.4 score should be read as a ceiling on immediate technical severity given the PR:H and UI:R prerequisites; organizations with remotely accessible admin interfaces or weak credential hygiene face materially higher effective risk.

Detection Guidance

Sigma Rule

title: Edimax BR-6208AC formFilter XSS Attempt
id: 8f3c2a91-4b7e-4d2a-9c1f-6a5e0d3b7f21
status: experimental
description: Detects HTTP requests to the Edimax /goform/formFilter endpoint containing script-like payloads consistent with CVE-2026-108933 XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108933
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: edimax
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/goform/formFilter'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '<svg'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate admin form submissions containing angle brackets in filter comments
level: medium
tags:
  - attack.t1190
  - cve.2026-108933

YARA Rule

rule CVE_2026_108933_Edimax_FormFilter_XSS
{
    meta:
        description = "Detects XSS payload strings targeting the Edimax BR-6208AC /goform/formFilter endpoint"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108933"
        date = "2026-01-01"
        cve = "CVE-2026-108933"

    strings:
        $endpoint = "/goform/formFilter" ascii wide nocase
        $xss1 = "<script" ascii wide nocase
        $xss2 = "javascript:" ascii wide nocase
        $xss3 = "onerror=" ascii wide nocase
        $xss4 = "onload=" ascii wide nocase
        $xss5 = "%3Cscript" ascii wide nocase

    condition:
        $endpoint and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108933 Edimax BR-6208AC formFilter XSS Attempt"; flow:established,to_server; http.uri; content:"/goform/formFilter"; nocase; http.uri; content:"<script"; nocase; pcre:"/(%3C|<)script/i"; classtype:web-application-attack; reference:cve,2026-108933; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108933; sid:2026108933; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      url.path contains "/goform/formFilter" ]
  [ network where http.request.method in ("GET","POST") and
      (url.query contains "<script" or url.query contains "onerror=" or
       url.query contains "javascript:" or url.query contains "<svg") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| eval body=coalesce(form_data, request_body, cs_uri_query)
| where like(uri, "%/goform/formFilter%")
| where match(body, "(?i)(<script|%3Cscript|onerror=|onload=|javascript:|<svg|<img)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, body
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-108933,">
  <rule id="100933" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/goform/formFilter</match>
    <regex type="pcre2">(?i)(%3C|<)script|onerror=|onload=|javascript:</regex>
    <description>CVE-2026-108933: Possible XSS attempt against Edimax BR-6208AC /goform/formFilter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,cve_2026_108933,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted early about the disclosure and did not respond; no fixed firmware version is known.

1. Immediate mitigations

   • Remove the BR-6208AC management interface from WAN exposure. Disable remote administration if enabled, and restrict admin access to trusted internal segments only.
   • Enforce strong, unique administrator credentials and avoid shared admin accounts; PR:H means the flaw is gated behind authenticated access.
   • Segment router management onto an isolated VLAN with access control lists, limiting which hosts can reach /goform/formFilter.
   • Treat the admin plane as untrusted-content-bearing: instruct administrators not to browse to crafted links while authenticated to the router, and to log out of the admin UI when not in use (UI:R mitigation).
   • Consider network-level filtering of script-like payloads directed at /goform/formFilter using the Suricata/Wazuh rules above.

2. Patch / upgrade steps

   • No vendor patch is available. Monitor Edimax's support and firmware pages for the BR-6208AC for any firmware release newer than 1.32 that addresses the reported XSS.
   • If no fix materializes, plan replacement of the device with a supported router that receives security updates, or isolate it to a role where its management plane cannot be reached by untrusted users.

3. Long-term hardening

   • Maintain an inventory of SOHO/edge devices and their firmware versions; track EOL and unpatched network gear explicitly.
   • Apply an assume-breach model to router management: unique credentials, MFA where supported, and out-of-band management.
   • Continuously monitor for changes to the CVE record, vendor response, or the emergence of public exploit tooling (none currently tracked).

References

• NVD — CVE-2026-108933: https://nvd.nist.gov/vuln/detail/CVE-2026-108933
• MITRE CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• FIRST EPSS (currently unscored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Edimax product support (BR-6208AC firmware; no vendor advisory located — vendor did not respond to disclosure)

No threat-actor campaign, exploit-in-the-wild evidence, or KEV listing is currently associated with CVE-2026-108933.