CVE-2026-108936

Executive Summary

CVE-2026-108936 is a cross-site scripting (XSS) vulnerability in Edimax BR-6208AC firmware version 1.32, specifically affecting the QoS Page handling of the /goform/formQoS endpoint. An attacker who can manipulate input processed by this component may inject script content that executes in the context of an authenticated administrator's browser. The vulnerability is remotely reachable but requires high privileges and user interaction per the assigned CVSS vector, resulting in a low integrity impact with no confidentiality or availability impact. The vendor did not respond to disclosure, and no patch is currently available.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly "Cross-Site Scripting"). According to the NVD description, the affected component is the QoS Page of the Edimax BR-6208AC running firmware 1.32, and the vulnerable file is /goform/formQoS. The description states that "an unknown part of the file" is affected, meaning the exact parameter, field, or handler responsible for the missing output encoding is not publicly documented at this time. No specific parameter names, function names, or sink locations beyond /goform/formQoS can be confirmed from the available data.

At the vulnerability-class level, reflected or stored XSS in embedded router management interfaces typically arises when user-supplied input is written into an HTML response without context-appropriate encoding or validation. In this case, the QoS configuration page processes input submitted to /goform/formQoS, and the lack of neutralization allows attacker-controlled markup or script to be rendered in the administrative web UI.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N, scoring 2.4:

• AV:N (Network) — the vulnerable interface is reachable over the network, consistent with a router management page accessible via LAN or, if management is exposed, WAN.
• AC:L (Low) — no special conditions are required to attempt the attack.
• PR:H (High) — the attacker must possess administrative-level privileges or be able to influence input that only a privileged user can submit/trigger.
• UI:R (Required) — successful exploitation depends on a victim user interacting with the crafted input or page.
• S:U (Unchanged) — the impact is confined to the vulnerable component's security scope.
• C:N / I:L / A:N — no confidentiality or availability impact; low integrity impact, typical of script injection that can alter content or configuration presentation.

Because the description explicitly notes the exploit "has been disclosed publicly and may be used," defenders should treat the technique as known even though no PoC code, Nuclei template, or exploit repository is tracked in the provided data. No EPSS score is available (not yet scored by FIRST.org), and the CVE is not listed in CISA KEV.

Exploitation Scenarios

The attack chain below is described at the vulnerability-class level, since the NVD description does not disclose the exact parameter or injection point. No public PoC is available in the provided data; the chain is inferred from the XSS vulnerability class and the stated affected endpoint.

1. Reconnaissance / target identification. An attacker scans for Edimax BR-6208AC devices, for example via internet-wide scanning using Shodan dorks (see METADATA) or by enumerating hosts on a network where the device management interface is reachable. The QoS Page associated with /goform/formQoS is the target surface. Devices with the management interface exposed beyond the trusted LAN present the largest exposure, though the PR:H requirement indicates the attacker must operate with or leverage administrative access.

2. Triggering the flaw class. The attacker crafts input containing script content intended for the QoS configuration handling at /goform/formQoS. Because the component fails to neutralize input during web page generation (CWE-79), the injected content is not safely encoded when the QoS Page is rendered.

3. Payload / execution. Per the XSS class, the crafted input causes script to execute in the browser context of a user viewing the QoS Page. The UI:R condition means a victim (typically an authenticated administrator) must load or interact with the affected page for execution to occur. The exact injection vector (e.g., a specific form field submitted to /goform/formQoS) is not specified in the available description and should not be assumed.

4. Post-exploitation impact. Consistent with the C:N/I:L/A:N subscores, impact is limited to low integrity within the victim's browser session on the device UI — for example, manipulation of displayed content or configuration presentation. There is no scored confidentiality or availability impact, and scope is unchanged. Because the victim context is an authenticated administrator, script execution could theoretically be leveraged to perform UI-redressing or action-substitution within that session, but the CVSS scoring reflects a low overall severity.

Impact Assessment

CVE-2026-108936 affects Edimax BR-6208AC firmware 1.32. The blast radius is limited to deployments of this specific device model and firmware where the administrative interface is reachable and an administrator can be induced to interact with attacker-influenced input (PR:H + UI:R). The CVSS base score of 2.4 (Low) reflects:

• No confidentiality impact (C:N) — no direct data exfiltration is scored.
• Low integrity impact (I:L) — potential modification of page content or presented configuration data within the UI.
• No availability impact (A:N) — device functionality is not directly disrupted.

Business impact is correspondingly modest at the scoring level, but the operational context matters: these are network edge devices, and administrative sessions on them are sensitive. If the management UI is exposed on the WAN side, the reachability (AV:N) increases practical risk. However, the requirement for high privileges (PR:H) and user interaction (UI:R) constrains realistic exploitation to scenarios involving an authenticated admin or social engineering of one. Since the vendor was contacted and did not respond, no fixed firmware version is documented, and the device should be considered unpatched.

Detection Guidance

Sigma Rule

title: Potential XSS Attempt Against Edimax BR-6208AC QoS Page (/goform/formQoS)
id: 7f3c1b2a-9d4e-4c8a-b1f0-2a6e5c9d8f01
status: experimental
description: Detects HTTP requests to the Edimax BR-6208AC QoS endpoint containing common XSS payload indicators in query or body parameters.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108936
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: edimax
detection:
  selection_uri:
    cs-uri-stem|contains: '/goform/formQoS'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '<svg'
      - 'alert('
  condition: selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate administrative configuration containing special characters
level: medium
tags:
  - attack.t1190
  - cve.2026.108936

YARA Rule

rule CVE_2026_108936_Edimax_QoS_XSS
{
    meta:
        description = "Detects common XSS payload patterns targeting the Edimax BR-6208AC QoS endpoint /goform/formQoS"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108936"
        date = "2026-01-01"
        cve = "CVE-2026-108936"

    strings:
        $ep   = "/goform/formQoS" ascii nocase
        $xss1 = "<script" ascii nocase
        $xss2 = "javascript:" ascii nocase
        $xss3 = "onerror=" ascii nocase
        $xss4 = "onload=" ascii nocase
        $xss5 = "%3Cscript" ascii nocase
        $xss6 = "alert(" ascii nocase

    condition:
        $ep and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108936 Edimax BR-6208AC QoS Page XSS Attempt (/goform/formQoS)"; flow:established,to_server; http.uri; content:"/goform/formQoS"; nocase; http.uri; pcre:"/(%3C|<)script|javascript:|onerror=|onload=|alert\(/Ui"; classtype:web-application-attack; reference:cve,2026-108936; sid:2026108936; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and url.path == "/goform/formQoS" and url.query : ("*<script*" or "*%3Cscript*" or "*onerror=*" or "*onload=*" or "*javascript:*")]
  [network where http.request.method in ("POST", "GET") and url.path == "/goform/formQoS"]

Splunk SPL Query

index=web OR index=proxy
| search uri_path="/goform/formQoS"
| eval payload = lower(uri_query . " " . form_data)
| where match(payload, "(<script|%3cscript|javascript:|onerror=|onload=|alert\\(|<svg|<img)")
| table _time, src_ip, dest_ip, http_method, uri_path, uri_query, form_data, user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="web,edimax,cve-2026-108936,">
  <rule id="100936" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>/goform/formQoS</match>
    <regex>(?i)(%3Cscript|<script|javascript:|onerror=|onload=|alert\()</regex>
    <description>CVE-2026-108936: Possible XSS attempt against Edimax BR-6208AC /goform/formQoS QoS page</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,cve_2026_108936,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed firmware version is documented; the vendor was contacted but did not respond.

1. Immediate mitigations

   • Restrict access to the device management interface. Do not expose the Edimax BR-6208AC administrative UI (including the QoS Page at /goform/formQoS) to the WAN or untrusted networks; limit it to a trusted management VLAN or specific administrative hosts.
   • Enforce strong administrative credentials and avoid shared admin accounts, since exploitation requires high privileges (PR:H).
   • Apply network-layer filtering to block inbound requests to /goform/formQoS from untrusted sources.
   • Warn administrators against clicking untrusted links while logged into the device UI, given the UI:R requirement.

2. Patch / upgrade steps

   • No patch is currently available. Monitor the Edimax security advisory and support channels for a firmware update addressing CVE-2026-108936.
   • Do not assume a fixed version exists; verify any firmware release notes explicitly reference this CVE before upgrading.

3. Long-term hardening

   • If no firmware fix materializes, plan to replace or decommission affected BR-6208AC 1.32 devices or isolate them strictly.
   • Maintain an asset inventory of embedded network devices and their firmware versions to detect unpatched, end-of-life hardware.
   • Deploy the detection rules above (Sigma, YARA, Suricata, Elastic, Splunk, Wazuh) to monitor for XSS attempts against /goform/formQoS.
   • Adopt a vendor-responsiveness policy: prioritize migration away from products whose vendors fail to acknowledge security disclosures.

References

• NVD — CVE-2026-108936: https://nvd.nist.gov/vuln/detail/CVE-2026-108936
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Edimax official product/security support page: https://www.edimax.com/
• CISA KEV Catalog (CVE-2026-108936 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is tracked in the provided data. No threat actor campaign or exploit-in-the-wild evidence is documented for this CVE in the supplied intelligence.