CVE-2026-108935

Executive Summary

CVE-2026-108935 is a cross-site scripting (XSS) vulnerability (CWE-79) affecting Edimax BR-6208AC firmware version 1.32, specifically in the /goform/formPortFw endpoint handling the Port Forwarding configuration page. An authenticated attacker with high privileges can inject script that executes in a victim administrator's browser context when the crafted request is processed and the resulting page is rendered. Successful exploitation yields limited integrity impact (CVSS 2.4), and a public exploit exists, but the vendor has not responded to disclosure and no patch is available.

Technical Analysis

The vulnerability resides in the Port Forwarding Page component of the Edimax BR-6208AC, served through the /goform/formPortFw handler. This endpoint processes configuration parameters for port-forwarding rules and reflects user-supplied input back into the generated HTML response without adequate output encoding or sanitization. Because the input is returned to the browser unescaped, an attacker can supply a value containing HTML/JavaScript markup that the victim's browser executes as part of the page.

The weakness maps to CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The reflected/rendered input executes in the security context of the router's administrative web interface, meaning that any script runs with the privileges of the logged-in administrator session.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N, giving a base score of 2.4:

• AV:N (Network) — the vulnerable HTTP handler is reachable over the network.
• AC:L (Low) — no specialized conditions are required to trigger the flaw.
• PR:H (High) — the attacker must already hold administrative privileges or an authenticated session to reach /goform/formPortFw.
• UI:R (User Interaction) — a victim user must load or interact with the crafted page/request for script execution to occur.
• S:U (Unchanged) — the exploit does not cross a privilege or trust boundary beyond the vulnerable component.
• C:N / I:L / A:N — no confidentiality or availability impact; limited integrity impact resulting from possible in-session manipulation of the admin interface.

The attack surface is the router's administrative web management interface, normally exposed on the LAN by default but frequently reachable remotely when remote management is enabled or the device is internet-facing. No code-level function or parameter names are disclosed in the NVD description beyond the file /goform/formPortFw and the Port Forwarding Page component; further implementation specifics are not available. No public PoC repository or Nuclei template has been confirmed in the supplied data, though the NVD entry states the exploit has been made public.

Exploitation Scenarios

Because the disclosure provides limited implementation detail, the following chain is described at the vulnerability-class level. No specific function names, parameter names, or payload strings beyond /goform/formPortFw are asserted here.

1. Reconnaissance / target identification. The attacker identifies an Edimax BR-6208AC device (firmware 1.32) whose administrative web interface is reachable — typically on the local network, or over the internet if remote management is enabled. Fingerprinting can be performed using HTTP responses and exposed banners. The attacker must obtain valid administrative credentials or a hijacked administrative session, consistent with the PR:H rating.

2. Triggering the flaw class. Once authenticated, the attacker crafts a request to the /goform/formPortFw Port Forwarding handler in which an input field associated with a port-forwarding rule contains HTML/JavaScript markup. Because the handler reflects user-controlled input into the resulting page without proper output encoding (CWE-79), the injected markup is emitted into the response.

3. Payload / execution method. At the vulnerability-class level, the attacker delivers a crafted page or link that causes a victim administrator's browser to load the affected response. The injected script then executes in the origin of the router's administrative interface. Standard reflected-XSS delivery methods apply — for example, a link a victim is induced to open while authenticated, or stored content rendered by the router UI. (No public PoC is asserted here; the chain is inferred from the vulnerability class.)

4. Post-exploitation impact. Executing script in the admin context allows the attacker to act within the authenticated interface — potentially altering router configuration or reading the contents of the admin page — but the CVSS subscores cap this at limited integrity impact only (I:L), with no confidentiality or availability impact. The primary risk is manipulation of administrative UI state and configuration through a hijacked session.

Impact Assessment

The direct technical impact is limited: CVSS 2.4 with integrity-only impact (I:L) and no confidentiality (C:N) or availability (A:N) effect. Scoped as Unchanged, exploitation stays within the vulnerable component. The realistic business risk stems from the device role: the BR-6208AC is an edge/SOHO router whose administrative interface governs forwarding rules, network access, and connected-device behavior. A hijacked admin session or manipulated configuration could indirectly enable further abuse (e.g., altered port-forwarding rules), but the rating defines the direct impact as low. The blast radius is limited by the requirement for high privilege (PR:H) and user interaction (UI:R), meaning the attacker generally needs to already control admin access or trick an authenticated admin. Affected systems are Edimax BR-6208AC devices running firmware 1.32; no other products or version ranges are confirmed in the supplied data. The existence of a public exploit and the vendor's non-response (unpatched, patch confidence 0/4) elevate ongoing risk for internet-exposed or managed deployments of this device.

Detection Guidance

Detection should target attempted injection into the Port Forwarding handler (/goform/formPortFw), anomalous script-like content in HTTP requests to router management endpoints, and unexpected admin-interface requests. Note that legitimate administrative traffic to /goform/formPortFw is expected — tune detections to flag suspicious markup rather than all access.

Sigma Rule

title: Possible XSS Attempt Against Edimax BR-6208AC Port Forwarding Handler
id: 3f5c1e2a-9b47-4d8e-a1c2-7e6f0b9d4a11
status: experimental
description: Detects HTTP requests to the Edimax BR-6208AC /goform/formPortFw endpoint containing script-like payload markers indicative of CWE-79 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108935
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/goform/formPortFw'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
      - '"><'
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate administrative configuration containing special characters
level: medium
tags:
  - attack.t1059.007
  - cwe.79

YARA Rule

rule CVE_2026_108935_Edimax_XSS
{
    meta:
        description = "Detects script injection markers targeting Edimax BR-6208AC Port Forwarding handler"
        cve = "CVE-2026-108935"
        cwe = "CWE-79"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $endpoint = "/goform/formPortFw" ascii wide nocase
        $x1 = "<script" ascii wide nocase
        $x2 = "javascript:" ascii wide nocase
        $x3 = "onerror=" ascii wide nocase
        $x4 = "onload=" ascii wide nocase

    condition:
        $endpoint and any of ($x*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108935 Edimax BR-6208AC Port Forwarding XSS Attempt"; flow:established,to_server; http.uri; content:"/goform/formPortFw"; nocase; http.uri; content:"<script"; nocase; sid:2026108935; rev:1; reference:cve,2026-108935; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108935; classtype:web-application-attack;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      http.request.path : "*goform/formPortFw*" ]
  [ network where network.protocol == "http" and
      (http.request.body : "*<script*" or
       http.request.body : "*javascript:*" or
       http.request.path : "*<script*" or
       http.request.path : "*onerror=*") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_stem)
| eval query=coalesce(query, cs_uri_query, url)
| where like(uri, "%/goform/formPortFw%")
| where match(lower(query), "(<script|javascript:|onerror=|onload=|%3cscript)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src) as sources by uri, query
| sort - count

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-108935,">
  <rule id="108935" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/goform/formPortFw</url>
    <regex type="pcre2">(?i)(%3Cscript|&lt;script|<script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-108935: Possible XSS attempt against Edimax BR-6208AC Port Forwarding handler (/goform/formPortFw)</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>web_attack,cwe_79,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version is available; the vendor was contacted but did not respond.

1. Immediate mitigations

   • Restrict access to the administrative web interface so that /goform/formPortFw is reachable only from trusted management hosts; disable remote/web management from the WAN where the device supports it.
   • Segment the router/management network so untrusted clients cannot reach the admin UI.
   • Enforce strong, unique administrative credentials and avoid reusing sessions across untrusted networks to reduce the PR:H foothold attackers require.
   • Treat device administrative sessions as untrusted: avoid navigating to third-party links or content while an admin session is active (mitigates the UI:R component).
   • Where possible, place a WAF or reverse proxy in front of the management interface to filter script-like markup directed at the handler.

2. Patch / upgrade steps

   • No patched firmware exists. Monitor Edimax security advisories and the NVD entry for CVE-2026-108935 for any future fixed release.
   • If a fixed firmware version is later published, schedule an upgrade immediately and verify the version post-upgrade against the vendor advisory.
   • If no fix materializes and the device cannot be protected, consider replacement with a supported, actively maintained router.

3. Long-term hardening

   • Maintain an inventory of edge/SOHO devices and track firmware against vendor advisories; retire devices with unresponsive vendors.
   • Enable and retain web-access logs for the management interface and forward them to the SIEM for the detections above.
   • Apply defense-in-depth: network segmentation, least-privilege administration, and out-of-band management.
   • Adopt a policy of disabling unused management interfaces and enforcing TLS-only administrative access where supported.

References

• NVD — CVE-2026-108935: https://nvd.nist.gov/vuln/detail/CVE-2026-108935
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — JavaScript/JScript: https://attack.mitre.org/techniques/T1059/007/
• Edimax product/security information: https://www.edimax.com
• CISA Known Exploited Vulnerabilities Catalog (not listed for this CVE as of disclosure): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign or exploit-in-the-wild evidence: none confirmed in the supplied data. The NVD entry states a public exploit exists and "could be used for attacks," but no named campaign, malware family, or KEV listing is associated with CVE-2026-108935 at this time.