Edimax BR-6208AC 1: command injection

Edimax BR-6208AC

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

Do this now

Check Edimax's advisory for a fix for the BR-6208AC and restrict access to its web interface until one is confirmed.

Still cooking for BR-6208AC.

First seen: 5 Nov 2026
Last update: 5 Nov 2026, 06:17 UTC
Identifiers: CVE-2026-122051
CVSS: 10.0
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Edimax BR-6208AC 1: command injection
Severity: critical. Patch status: fix status unknown.
Affected: Edimax BR-6208AC
Ids: CVE-2026-122051

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used.

## Steps
1. Search the repo, its CI and infra config for Edimax BR-6208AC. If present, report the version in use and whether it's affected.
2. BR-6208AC 1.32.x: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| BR-6208AC 1.32.x | not named in the CVE record | check the vendor advisory: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_mp | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-122051") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_mp https://nvd.nist.gov/vuln/detail/CVE-2026-122051
https://pwned.coffee/i/edimax-br-6208ac-1-command-injection-cve-2026-122051

Receipt

Exploitation: Public exploit code, no attacks reported
CISA ADP “CISA ADP rates exploitation of CVE-2026-122051 "poc" (SSVC).” source
Fix by release line: Product Affected Fixed in Source
BR-6208AC = 1.32 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: github.com
Score: CVSS 10.0 (critical). CVSS 3.1 10 (CNA VulDB) for CVE-2026-122051
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Fixed in	Source
BR-6208AC	= 1.32	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee