CVE-2026-108936
2.4LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79, CWE-94
Impact
An authenticated attacker with high privileges can execute stored cross-site scripting attacks against another admin's browser session. They need network access to the router's web interface and credentials with administrative rights to modify QoS settings.
Root cause
The /goform/formQoS endpoint on the QoS configuration page improperly neutralizes user-supplied input before reflecting it back into the web interface.
Affected systems
Edimax BR-6208AC version 1.32
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
No vendor patch is available as Edimax did not respond. Restrict access to the router's web management interface to trusted subnets or dedicated management IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.