CVE-2026-108935: Edimax BR-6208AC XSS Vulnerability

CVE-2026-108935 Overview

CVE-2026-108935 is a cross-site scripting (XSS) vulnerability in the Edimax BR-6208AC router running firmware version 1.32. The flaw resides in the /goform/formPortFw endpoint that backs the Port Forwarding configuration page. An authenticated remote attacker can inject script content through unsanitized input handled by this component. The weakness is tracked under CWE-79. A public proof-of-concept is available in a GitHub IoT vulnerability repository. According to the disclosure in VulDB, the vendor was contacted early but did not respond.

Critical Impact
An authenticated attacker can inject persistent JavaScript via the Port Forwarding page, enabling session theft, administrative action hijacking, or redirection of other administrators who view the affected configuration.

Affected Products

Edimax BR-6208AC router
Firmware version 1.32
Component: Port Forwarding Page (/goform/formPortFw)

Discovery Timeline

2026-10-12 - CVE-2026-108935 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-108935

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting flaw in the Edimax BR-6208AC web administration interface. The /goform/formPortFw handler accepts user-controlled input for defining port forwarding rules without applying adequate output encoding or input sanitization. When the resulting configuration is rendered back in the Port Forwarding management view, attacker-supplied markup executes in the browser context of the administrator session. The flaw requires high privileges and user interaction to exploit, which limits scope, but it still enables an attacker with router credentials to pivot against other administrators sharing the device.

Root Cause

The root cause is improper neutralization of input during web page generation (CWE-79). Parameters submitted to /goform/formPortFw are stored and later reflected into the Port Forwarding configuration page without HTML entity encoding or allow-list validation.

Attack Vector

Exploitation occurs over the network against the router's management interface. The attacker must hold valid administrative credentials and the victim administrator must view the manipulated Port Forwarding page. Successful execution runs attacker-controlled JavaScript within the authenticated session context. This can facilitate credential theft, forced configuration changes, and persistent backdoors in router settings. Technical details and a working payload are available in the public PoC repository.

Detection Methods for CVE-2026-108935

Indicators of Compromise

HTTP POST requests to /goform/formPortFw containing script tags, event handlers (for example onerror=, onload=), or URL-encoded JavaScript payloads.
Unexpected port forwarding rules with names or descriptions containing HTML or JavaScript syntax.
Administrator sessions issuing configuration changes immediately after loading the Port Forwarding page.

Detection Strategies

Inspect router web traffic for payload patterns matching <script, javascript:, or encoded variants submitted to formPortFw parameters.
Review router configuration backups for port forwarding entries containing non-alphanumeric characters that fall outside the expected rule syntax.
Correlate administrative logins with sudden changes to DNS, firewall, or forwarding rules that could indicate script-driven abuse.

Monitoring Recommendations

Place the router management interface behind a management VLAN and log all HTTP(S) access to /goform/* endpoints.
Enable browser-side logging or an inline web proxy to capture reflected content served from the admin UI.
Alert on configuration diffs for the Port Forwarding section through scheduled SNMP or SSH-based audits.

How to Mitigate CVE-2026-108935

Immediate Actions Required

Restrict access to the Edimax BR-6208AC administrative interface to trusted management hosts only.
Rotate administrator credentials and disable any shared or default accounts on the device.
Review existing port forwarding rules and remove entries containing suspicious characters or markup.
Avoid browsing other sites while authenticated to the router and log out immediately after administration.

Patch Information

No vendor patch is available at the time of publication. According to the VulDB entry, Edimax was notified prior to disclosure but did not respond. Organizations relying on BR-6208AC 1.32 should plan for replacement or compensating controls until the vendor issues an update.

Workarounds

Disable remote WAN-side management of the router and enforce LAN-only administration.
Use a dedicated browser profile or isolated workstation strictly for router administration to limit session reuse by malicious scripts.
Place the device behind a network segmentation boundary and restrict administrative access by source IP via upstream firewall rules.
Consider migrating to a supported router model if the vendor continues to decline remediation.

bash

# Example upstream firewall restriction limiting access to the router admin UI
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -s <admin_mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s <admin_mgmt_subnet> -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP