{"id":"CVE-2026-108915","published":"2026-10-12T18:17:21Z","modified":"2026-10-13T17:17:22Z","title":"A vulnerability has been found in Edimax BR-6208AC 1.32","vendor":"Edimax","product":"BR-6208AC","tier":"core","eol":null,"description":{"text":"A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.","provenance":"source","from":"NVD"},"summary":{"text":"A buffer overflow in the /goform/formWlanMP component of the Edimax BR-6208AC 1.32 router firmware is triggered by manipulating the ateBW argument. An attacker can exploit it remotely, and the attack requires only low-privilege authentication with no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:18:56Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00445,"percentile":0.38746,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"},{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/BR-6208AC/BufferOverflow_formWlanMP","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108915","tags":[]},{"url":"https://vuldb.com/submit/977196","tags":[]},{"url":"https://vuldb.com/vuln/416727","tags":[]},{"url":"https://vuldb.com/vuln/416727/cti","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-97725","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97725","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108915","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":14.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.75,"detail":"percentile 0.3875"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}