CVE-2025-15256CWE-74CWE-77

Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection

Medium · published December 30, 2025

CVSS v4.0
6.9
EPSS
4%
Percentile
89.9
In the wild
Unconfirmed
What it is

⚠️ A crafty command injection lurks in the Edimax BR-6208AC! Just by tweaking one argument, an attacker could throw a wrench into your network! 🔥 Think of this like a hotel concierge who doesn’t check guest IDs. If a clever con artist calls in claiming to be someone else, they could easily access all the rooms without a second thought! An attacker exploiting this vulnerability could gain remote access to your device, allowing them to run arbitrary commands, modify settings, or even compromise your network security. While this may not be a catastrophic breach, it’s definitely a sneaky way to expose your devices to risks and unauthorized control.

Put simply

Think of this like a hotel concierge who doesn’t check guest IDs. If a clever con artist calls in claiming to be someone else, they could easily access all the rooms without a second thought! This command injection vulnerability in the Edimax BR-6208AC's web-based configuration allows attackers to manipulate the 'rootAPmac' argument, enabling malicious commands to be executed remotely without any authentication.

What to do

An attacker exploiting this vulnerability could gain remote access to your device, allowing them to run arbitrary commands, modify settings, or even compromise your network security. While this may not be a catastrophic breach, it’s definitely a sneaky way to expose your devices to risks and unauthorized control. Since the Edimax BR-6208AC has reached its End of Life, the best action is to upgrade to a newer, supported model to ensure ongoing security updates and patches. If you're still using this device, consider replacing it as soon as possible to avoid potential exploitation. You’ve got this! By upgrading, you’ll be stepping up your security game and keeping your network safe. 🛡️

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.03761 · 89.9th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-12-30T16:32Z
EPSS history
Timeline
  • 30 DEC 16:32Z
    Edimax BR-6208AC Web-based Configuration formStaDrvSetup command injection
    cvelistv5