CVE-2026-108934
2.4LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers with administrative privileges can execute arbitrary JavaScript in another user's browser via cross-site scripting if they trick the user into interacting with the web interface. A public exploit is available.
Root cause
The HTTP Blocking Page endpoint (/goform/formUrlb) fails to sanitize input, leading to cross-site scripting.
Affected systems
Edimax BR-6208AC version 1.32.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor fix is available. Restrict access to the router's management web interface so it cannot be reached from untrusted networks or the public internet.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb of the component HTTP Blocking Page. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.