---
id: CVE-2026-122051
title: Edimax BR-6208AC mp command injection
summary: >-
  A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability
  is an unknown functionality of the file /goform/mp. Executing a manipulation
  can lead to command injection. The attack may be launched remotely. The
  exploit h…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-77
  - CWE-74
vendor: Edimax
product: BR-6208AC
affected:
  - BR-6208AC 1.32
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T20:30:07.744018Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:30:15.044Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122051'
references:
  - url: 'https://vuldb.com/vuln/431135'
    label: VDB-431135 | Edimax BR-6208AC mp command injection
  - url: 'https://vuldb.com/vuln/431135/cti'
    label: 'VDB-431135 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-122051'
    label: CVE-2026-122051 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1025459'
    label: 'Submit #1025459 | Edimax BR-6208AC BR-6208AC_1.32 Command Injection'
  - url: 'https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/RCE_mp'
tags:
  - cve.org
  - exploit-available
epss: 0.02575
epssPercentile: 0.8528
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/carterlasalle/CVE-2026-122051'
  checkedAt: '2026-11-07T18:08:18.788Z'
ingestedAt: '2026-11-05T22:38:31.791Z'
---

## Overview

A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `BR-6208AC 1.32`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.