CVE-2026-108935
2.4LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
Remote attackers with high privileges can execute cross-site scripting attacks if an administrative user is tricked into triggering the payload. This requires network access, admin credentials, and user interaction.
Root cause
Improper input sanitization of parameters handled by /goform/formPortFw on the Port Forwarding configuration page.
Affected systems
Edimax BR-6208AC version 1.32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is available. Restrict access to the router web management interface to trusted internal IP addresses and avoid navigating untrusted links while logged in.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the component Port Forwarding Page. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.