{"id":"CVE-2026-108914","published":"2026-10-12T17:17:13Z","modified":"2026-10-15T14:17:15Z","title":"A flaw has been found in Edimax BR-6208AC 1.32","vendor":"Edimax","product":"BR-6208AC","tier":"core","eol":null,"description":{"text":"A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This manipulation of the argument ifname causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the Edimax BR-6208AC 1.32 router firmware lies in the /goform/formWlSiteSurvey handler, where the ifname argument is improperly bounds-checked. An attacker with network access and low-privilege authentication can send a crafted request to the ifname parameter with no user interaction needed, and because the vendor no longer supports the product, no fix is expected.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:17:58Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00567,"percentile":0.46964,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Oct 21, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad781365a703b9c48649e66","created":"2026-10-20"},{"name":"Known_Cve | Oct 20, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad62f6910d6449918d5e634","created":"2026-10-19"},{"name":"Known_Cve | Oct 19, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad4dda86020bf504fd274dd","created":"2026-10-18"},{"name":"Known_Cve | Oct 18, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad38c282daff94afd324191","created":"2026-10-17"},{"name":"Known_Cve | Oct 17, 2026 | Part 1/4","url":"https://otx.alienvault.com/pulse/6ad23ab08ed96f8b8bdea241","created":"2026-10-16"},{"name":"Known_Cve | Oct 16, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ad0e93a078e6220a69919cf","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6acf9878b4135e4a2037eb34","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ace4672cf606a4598005652","created":"2026-10-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"},{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/BufferOverflow_formWlSiteSurvey","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108914","tags":[]},{"url":"https://vuldb.com/submit/977194","tags":[]},{"url":"https://vuldb.com/vuln/416726","tags":[]},{"url":"https://vuldb.com/vuln/416726/cti","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-97574","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97574","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108914","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.39,"detail":"percentile 0.4696"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}