CVE-2026-108914

waiting for further signals

EUVD-2026-97574 ↗

no check availablenot proven exploitable

cve.orgpublic poc−558dkev

Edimax BR-6208AC 1.32

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

ETK-2026-1392, permanent identifier

cvss9.4cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

8d 11h 49msince last run

10mAI analysis

timeline

0 = cve.org publication

public poc−18.3motrigger signal (cve.org) +0mowaiting for further signals+0.0mo

−12mo

−6mo

description

Edimax BR-6208AC firmware 1.32 is affected by a buffer overflow in its site-survey form handler. An attacker who can reach the device management interface may be able to trigger the flaw remotely; the available evidence does not state whether authentication is required.

mitigation

Remove affected routers from untrusted networks and limit management-interface access to trusted administrators. Replace or retire affected devices, as no patched release is recorded.

check

exploit

automation

contextual

auth required

yes, low privileges

EPSS

0.57%45th percentile

agent run time

10m

cve.org record, t = 0

2026-10-12 17:00Z

Δ to public poc

−558d

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-12 17:00Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-108914
2026-10-12 18:05Z
fizz-is-on-the-way/Iot_vuls
github · https://github.com/fizz-is-on-the-way/Iot_vuls

this entry in the feed

GET /api/v1/feed/CVE-2026-108914

{
  "etk_id": "ETK-2026-1392",
  "cve_id": "CVE-2026-108914",
  "display_id": "CVE-2026-108914",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-97574",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Buffer overflow in Edimax BR-6208AC site survey handler",
  "summary": "Edimax BR-6208AC firmware 1.32 is affected by a buffer overflow in its site-survey form handler. An attacker who can reach the device management interface may be able to trigger the flaw remotely; the available evidence does not state whether authentication is required.",
  "mitigation": "Remove affected routers from untrusted networks and limit management-interface access to trusted administrators. Replace or retire affected devices, as no patched release is recorded.",
  "vendor": "Edimax",
  "product": "BR-6208AC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.32"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "BR-6208AC",
      "purl": null
    }
  ],
  "cwes": [
    120
  ],
  "cvss_score": 9.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
  "epss_score": 0.0057,
  "epss_percentile": 0.4599,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.1799731,
  "t0_at": "2026-10-12T17:00:20.439000+00:00",
  "signals": {
    "public_poc": {
      "at": "2025-04-02T07:53:04+00:00",
      "days": -558.3800513773148,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T17:00:20.439000+00:00",
      "url": "https://github.com/fizz-is-on-the-way/Iot_vuls"
    },
    "trigger_signal": {
      "at": "2026-10-12T17:00:20.439000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T17:00:20.439000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108914"
    }
  }
}

published 2026-10-12 17:46Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.